~/talk

Securing organizations pipelines and integrations in Azure DevOps Q&A

on YouTube 56m
Talkat Microsoft Build 2023 · 2023-05-23..05-25· [security, devops-and-delivery]

speakers

name:Dave Burnison
links:none on file
name:Tim Fish
linkedin:tim-fish-9a860432
name:Aaron Hallberg
links:none on file
name:Vijay Machiraju
links:none on file
name:Rajesh Ramamurthy
links:none on file
name:Olivia Shea
links:none on file

resources

video:https://youtu.be/ByIgEdK69po
slides:none on file

summary

Demos show three tenant policies that admins can enable now: restrict global personal access tokens, block creation of full‑scope PATs, and enforce a maximum PAT lifespan (example default 30 days) with allow‑list exceptions. A sample Azure Function moves from a long‑lived PAT to a managed identity migration and gets 60‑minute AAD tokens. Pipelines gain an audit‑only mode for queue‑time variables (audit log CSV export), and Azure service connections can use workload identity federation so no secrets are stored.

AI-written summary · about

chapters (5)

  1. 0:00Session introduction
  2. 4:46Personal access token policy
  3. 12:02Managed identity integration
  4. 21:34Pipeline and secret security
  5. 35:22Audience Q&A

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.