Azure DevOops 1 — It’s not my machines, it’s your code!

This blog post analyzes common Azure DevOps security weaknesses seen in red team engagements, emphasizing risks from overly broad project-level access, intricate and misapplied permissions, and insecure Personal Access Tokens (PATs) that enable repo-wide access and API-driven enumeration. It demonstrates how PATs can be used with the Azure DevOps REST API to query profiles and repositories, notes significant detection gaps due to limited auditing of developer activities, and contrasts Azure DevOps audit logs with Defender for Cloud’s scope. Recommendations include enforcing repository/branch policies, least-privilege PAT scopes, secure secret management, and forwarding audit logs to a SIEM to improve governance and detection.