AZDO.1038: (Organization) Disallow extensions from accessing resources on the local network.
| ID | AZDO.1038 |
| Severity | Medium |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Security policies |
| Security area | Applications and workload identities |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| MITRE ATT&CK | T1190 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/marketplace/allow-extensions-local-network?view=azure-devops |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Extensions should not be allowed to access resources on the local network.
Rationale: Allowing extensions to make requests to local network resources (loopback addresses like 127.0.0.1 or private IP ranges) increases the risk of server-side request forgery (SSRF) attacks. This policy should be disabled unless your extensions specifically require local network access.
Remediation action
Section titled “Remediation action”Disable the policy to prevent extensions from accessing local network resources.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies, locate the “Allow extensions to access resources on the local network” policy and toggle it to off.
Results: With the policy disabled, extensions cannot make requests to loopback addresses or private IP address ranges, reducing the risk of SSRF attacks.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.