Skip to content

Azure.DevOps.ServiceConnections.Scope

Jump to bottom
github-actions edited this page Oct 21, 2023 · 5 revisions

category: Microsoft Azure DevOps Service Connections severity: Severe online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.ServiceConnections.Scope.md

Azure.DevOps.ServiceConnections.Scope

SYNOPSIS

A service connection scoped to production should use a narrow scope. This will help ensure no unwanted changes or access is made to the production resources or beyond

DESCRIPTION

A service connection scoped to production should use a narrow scope. For example, a service connection scoped to production should only have access to the production resource groups. This will help ensure no unwanted changes or access is made to the production resources or beyond. Normally it is not desirable to have a service connection with access to all resource groups in a subscription.

Mininum TokenType: ReadOnly

RECOMMENDATION

Consider using a resource group scope for a service connection scoped to production.

LINKS

Clone this wiki locally