AZDO.1027: Disable showing Gravatar images for users outside of your enterprise.
| ID | AZDO.1027 |
| Severity | Low |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Repositories |
| Security area | Engineering systems |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| MITRE ATT&CK | T1589.002 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/repos/git/repository-settings?view=azure-devops&tabs=browser#gravatar-images |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Gravatar images should not be exposed for users outside your enterprise.
Rationale: Gravatar images are served by an external service (gravatar.com) and may leak email hashes or profile information. Allowing them can reveal internal usernames or identities to outside observers and increases privacy risk.
Remediation action
Section titled “Remediation action”Disable the policy to stop these requests and notifications.
- On your Azure DevOps organization page, select Organization settings at lower left, and then select Repositories in the left navigation.
- On the All Repositories page, set Gravatar images to Off.
Results: With the setting disabled, user avatars use generic initials or local images only, preventing any information from being fetched from third-party servers.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.