Review and reduce platform-level administrative permissions
Implementation Effort: Medium – Auditing admin roles across GitHub and Azure DevOps and right-sizing each one takes methodical review and coordination with the teams that hold those roles. User Impact: Medium – Admins whose roles are downgraded lose capabilities they were used to, so the affected subset needs notice before their access changes. Lifecycle Stage: Govern
Overview
Review administrative roles across GitHub and Azure DevOps and remove or downgrade any that exceed what the holder's function requires. GitHub and Azure DevOps both provide granular role hierarchies — repository-level roles, team-based permissions, and custom security groups — that allow organizations to delegate specific capabilities without granting blanket administrative control. An engineer who needs to manage repository settings does not need organization-owner access, and a build engineer who configures pipelines does not need project-collection administrator rights.
Organizations often grant Owner or Admin roles broadly in early stages and rarely audit them. This creates a sprawl of over-privileged accounts — including developers, former team leads, and unused service accounts — each representing a potential entry point for threat actors to disable security controls, exfiltrate secrets, or tamper with pipelines.
Regularly right-size administrative roles so only a small, well-defined set of accounts can change platform security settings or release paths. Without recurring review, a single compromised high-privilege account can have an outsized blast radius across repositories, pipelines, and secrets. Right-sizing administrative roles is a direct application of Use least privilege access, and limiting how many accounts hold high-privilege roles supports Assume breach by reducing the blast radius of any single compromised identity.