> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/azure-devops/settings/control-evaluation.md).
# Control Evaluation
Control Evaluation is where you enable the token controls StepSecurity evaluates against your Azure DevOps organization, and set the thresholds they use. Settings here apply organization-wide.
Violations appear on the [Overview](/azure-devops/overview.md) page and in [Identities & PATs](/azure-devops/identities-and-pats.md).
**To reach this page:** open the sidebar and go to Settings > Control Evaluation.
### Personal Access Token controls
Each control has its own toggle. When a control is off, it is not evaluated, no findings are generated for it, and its notification events do not fire, regardless of what is selected under [Settings > Notifications](/azure-devops/settings/notifications.md). Turning it back on resumes evaluation on the next hourly scan.
Controls that take thresholds show their fields directly beneath them once enabled.
| Control | Severity | Thresholds |
| ------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Tokens Should Be Rotated Within Max Age** | High | **Max age (days)** is the longest lifetime allowed for a standard token. **High privilege max age (days)** applies the stricter limit to tokens holding high privilege scopes. **Remind at (days before expiry)** is a comma-separated list of reminder bands, for example `30, 7, 1` |
| **Tokens Should Have Minimum Scopes** | High | None. Toggle on to flag active tokens holding any of the 35 scopes Microsoft rates high privilege, or granting full access |
| **Tokens Should Be Actively Used** | Medium | **Unused for more than (days)** is the idle window for a standard token. **High privilege unused for more than (days)** applies the stricter window to tokens holding high privilege scopes |
| **Tokens Should Belong To Active Users** | Medium | None. Toggle on to flag active tokens whose owner has been deactivated in the directory or removed from the organization |
Select **Save** to apply changes.
### Choosing thresholds
The two controls with thresholds each use a pair of limits: one for standard tokens, and a stricter one for tokens holding high privilege scopes. This lets you leave routine tokens on a practical rotation cadence while forcing the tokens that can do the most damage onto a short leash.
Start by setting the standard limit to a value your teams can realistically meet, then tighten the high privilege limit. Setting a limit shorter than your teams' rotation practice will surface a large number of findings at once, so plan rollout alongside the owners who will act on them.
Reminder bands under **Remind at** control the pre-expiry notifications token owners receive, and work together with the **Remind before a token expires** event under [Settings > Notifications](/azure-devops/settings/notifications.md). Setting bands well before your max age gives owners time to rotate before a token starts failing the control.
{% hint style="info" %}
Changing a threshold re-evaluates the affected control on the next hourly scan. The token counts on the [Overview](/azure-devops/overview.md) page and each control detail page update at that point, not immediately on save.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.stepsecurity.io/azure-devops/settings/control-evaluation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
