Control Evaluation

Control Evaluation is where you enable the token controls StepSecurity evaluates against your Azure DevOps organization, and set the thresholds they use. Settings here apply organization-wide.

Violations appear on the Overview page and in Identities & PATs.

To reach this page: open the sidebar and go to Settings > Control Evaluation.

Personal Access Token controls

Each control has its own toggle. When a control is off, it is not evaluated, no findings are generated for it, and its notification events do not fire, regardless of what is selected under Settings > Notifications. Turning it back on resumes evaluation on the next hourly scan.

Controls that take thresholds show their fields directly beneath them once enabled.

Control	Severity	Thresholds
Tokens Should Be Rotated Within Max Age	High	Max age (days) is the longest lifetime allowed for a standard token. High privilege max age (days) applies the stricter limit to tokens holding high privilege scopes. Remind at (days before expiry) is a comma-separated list of reminder bands, for example 30, 7, 1
Tokens Should Have Minimum Scopes	High	None. Toggle on to flag active tokens holding any of the 35 scopes Microsoft rates high privilege, or granting full access
Tokens Should Be Actively Used	Medium	Unused for more than (days) is the idle window for a standard token. High privilege unused for more than (days) applies the stricter window to tokens holding high privilege scopes
Tokens Should Belong To Active Users	Medium	None. Toggle on to flag active tokens whose owner has been deactivated in the directory or removed from the organization

Select Save to apply changes.

Choosing thresholds

The two controls with thresholds each use a pair of limits: one for standard tokens, and a stricter one for tokens holding high privilege scopes. This lets you leave routine tokens on a practical rotation cadence while forcing the tokens that can do the most damage onto a short leash.

Start by setting the standard limit to a value your teams can realistically meet, then tighten the high privilege limit. Setting a limit shorter than your teams' rotation practice will surface a large number of findings at once, so plan rollout alongside the owners who will act on them.

Reminder bands under Remind at control the pre-expiry notifications token owners receive, and work together with the Remind before a token expires event under Settings > Notifications. Setting bands well before your max age gives owners time to rotate before a token starts failing the control.

Changing a threshold re-evaluates the affected control on the next hourly scan. The token counts on the Overview page and each control detail page update at that point, not immediately on save.