Azure DevOps Security Assessment
177 questions on an Azure DevOps organisation, from token scope to agent pools, scored per control.
177 controls · 10 pillars · 40 categories · evidence can be collected automatically
177 questions on an Azure DevOps organisation, from token scope to agent pools, scored per control.
177 controls · 10 pillars · 40 categories · evidence can be collected automatically
Delivery pipelines hold the credentials that reach production, and an approval that can be bypassed is not an approval. This assessment scores how change is authorised and how duties are separated across the platform that ships your software, independently of the team that built it. It gives you the change control and separation of duties evidence that auditors, regulators and large customers now expect in writing.
177 questions across 10 pillars and 40 categories, covering organisation and project governance, membership, administrative boundaries, tokens, branch policy, pipelines, deployment authorisation and build agents. A read-only collector reads configuration using a token you issue and can revoke; no pipeline is queued, run or edited and no agent is installed. The output is a score per pillar, which fits an ISO 27001 or SOC 2 window and doubles as the quarterly access review nobody enjoys preparing.
Looks at Entra ID backing and the tenant boundary, invitation control and access level hygiene, collection administrator boundaries and project permission inheritance, break-glass access, personal access token scope and lifetime, SSH keys and alternate authentication, third-party application authorisation, workload identity for pipeline automation, pull request review policy with author and pusher separation, branch policy bypass and force push, pipeline authorisation scope, untrusted input in pipeline runs, template reuse and task supply, production approvals and checks, protected resource scope and sharing, pipeline secret storage, and agent pool reach, patching, host hardening and network position. The collector reads these through the platform API and each finding becomes a suggestion the assessor accepts or overrides.
177 controls across 10 pillars and 40 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
A read-only collector script reads Azure DevOps organisation, project and pipeline configuration using a token you issue and can revoke, and every finding becomes a suggestion an assessor accepts or overrides before it is scored. Configuration the token cannot read is recorded as unread, never as a failure.
It can show that a production approval is configured and who may bypass it; it cannot tell you whether the approver actually looked at the change, which is a question for the interview.
Defence and critical infrastructure delivery teams have to show that build agents able to reach production networks are patched, isolated and scoped to a single project.
A public sector project can be made visible to the internet with one setting, and project visibility and public exposure is a scored category of its own.
Release authority and segregation of duties are the first thing a financial services auditor asks about, and both are scored alongside production approvals and checks.
In health and education estates long-lived personal access tokens outlive the staff who created them, so token scope and lifetime is scored rather than assumed.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is standard at 177 controls.
£3,500
Per engagement, excluding VAT.
£9,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.