Establish credential governance and blocking controls for developer platforms
Implementation Effort: Medium – Standing up recurring token, key, and service-connection reviews plus enforcement policies across both platforms is a multi-step effort with security and platform owners. User Impact: Low – Reviewing and revoking credentials and setting token policies are administrator actions; end users are not prompted. Lifecycle Stage: Govern
Overview
Establish a recurring review of personal access tokens, SSH keys, OAuth apps, and service connections, and revoke any that are unused, over-scoped, or no longer needed.
Because personal access tokens, SSH keys, and other non-interactive credentials are not reevaluated by Conditional Access on every use, they require separate restrictions, monitoring, and periodic attestation.
Review each platform through the controls it actually exposes. In GitHub, use enterprise or organization audit logs together with token policies, fine-grained PAT requirements, classic PAT restrictions, SSH key review, and review of OAuth apps or GitHub Apps. In Azure DevOps, use Auditing to track PAT creation and lifecycle events, apply PAT policies to reduce issuance and scope, and review service connections and other centrally managed credentials.
Note: Azure DevOps administrators can centrally revoke users' personal access tokens during incident response using the Token Administration REST API, and can revoke a specific user's PATs from organization settings. Combine central revocation with strict PAT policies — including expiration enforcement and scope limits — together with audit logs, continuous secret scanning, mandatory user attestation, and a policy requiring Microsoft Entra ID authentication where supported to reduce PAT dependency.
Fine-grained PATs are materially safer than classic PATs because they can be limited to specific repositories and explicit permissions, while classic PATs often grant broader account-level access and are harder to govern. Confirm that each credential or integration has a known owner and a documented purpose, verify that scopes follow least privilege, and revoke or disable anything that is orphaned, over-scoped, or past its intended lifespan.
Where administrators cannot enumerate every user credential directly, supplement administrative review with audit logs, secret scanning, token policies, and periodic attestation so long-lived credentials remain governed.
Long-lived credentials are issued once and remain valid until they expire or are manually revoked, so organizations accumulate an inventory of tokens and keys whose scope, ownership, and necessity become unknown over time. A leaked or stolen PAT or SSH key lets a threat actor access repositories, trigger pipelines, and exfiltrate secrets without triggering multi-factor authentication challenges or sign-in anomaly detections, and without periodic review that access can persist undetected for months. Regular credential reviews reduce this dwell time by keeping the active credential inventory known, minimal, and defensible.
Beyond reviewing existing credentials, organizations should enforce preventive controls at the platform level. GitHub Enterprise Cloud allows enterprise owners to set maximum lifetime policies for personal access tokens, require administrator approval before fine-grained PATs can access organization resources, and restrict or block classic PATs entirely. These policies ensure that new tokens are short-lived and scoped by default, reducing the window of exposure if a token is compromised. Combined with SSO enforcement — which automatically revokes PATs that have not been re-authorized after SAML authentication — enterprise PAT policies convert credential governance from a periodic review exercise into a continuous, platform-enforced control.