For the complete documentation index, see llms.txt. This page is also available as Markdown.

Control Evaluation

Control Evaluation is where you enable the token controls StepSecurity evaluates against your Azure DevOps organization, and set the thresholds they use. Settings here apply organization-wide.

Violations appear on the Overview page and in Identities & PATs.

To reach this page: open the sidebar and go to Settings > Control Evaluation.

Personal Access Token controls

Each control has its own toggle. When a control is off, it is not evaluated, no findings are generated for it, and its notification events do not fire, regardless of what is selected under Settings > Notifications. Turning it back on resumes evaluation on the next hourly scan.

Controls that take thresholds show their fields directly beneath them once enabled.

Control
Severity
Thresholds

Tokens Should Be Rotated Within Max Age

High

Max age (days) is the longest lifetime allowed for a standard token. High privilege max age (days) applies the stricter limit to tokens holding high privilege scopes. Remind at (days before expiry) is a comma-separated list of reminder bands, for example 30, 7, 1

Tokens Should Have Minimum Scopes

High

None. Toggle on to flag active tokens holding any of the 35 scopes Microsoft rates high privilege, or granting full access

Tokens Should Be Actively Used

Medium

Unused for more than (days) is the idle window for a standard token. High privilege unused for more than (days) applies the stricter window to tokens holding high privilege scopes

Tokens Should Belong To Active Users

Medium

None. Toggle on to flag active tokens whose owner has been deactivated in the directory or removed from the organization

Select Save to apply changes.

Choosing thresholds

The two controls with thresholds each use a pair of limits: one for standard tokens, and a stricter one for tokens holding high privilege scopes. This lets you leave routine tokens on a practical rotation cadence while forcing the tokens that can do the most damage onto a short leash.

Start by setting the standard limit to a value your teams can realistically meet, then tighten the high privilege limit. Setting a limit shorter than your teams' rotation practice will surface a large number of findings at once, so plan rollout alongside the owners who will act on them.

Reminder bands under Remind at control the pre-expiry notifications token owners receive, and work together with the Remind before a token expires event under Settings > Notifications. Setting bands well before your max age gives owners time to rotate before a token starts failing the control.

Changing a threshold re-evaluates the affected control on the next hourly scan. The token counts on the Overview page and each control detail page update at that point, not immediately on save.

Last updated

Was this helpful?