Audit Azure DevOps Pipelines, Agents, and Permissions with PowerShell
Inventory pipelines, agents, service connections, and project permissions across every Azure DevOps project from one PowerShell workflow.
Azure DevOps environments have a lot of moving parts: pipelines per repo, self-hosted agents per team, service connections per environment, and a permissions model that is just complex enough to drift.
The Azure DevOps REST API is fully scriptable from PowerShell. PSForge ships the ADO tasks you actually run against an organization, ready to assemble into one auditable workflow.
What slips in an Azure DevOps organization
- Pipelines that no longer build a deployable artifact but still run on a schedule
- Self-hosted agents on machines that fell off patching
- Service connections to subscriptions or vaults that nobody owns
- Project Administrators groups with a long tail of accounts that should not be there
- Pull request policies that drift between branches and projects
Why this is a workflow
All of these are correctable in isolation. The value is in running the audit on a cadence and routing each finding to the team that can fix it.
PSForge lets you assemble the ADO tasks into one workflow, generate the PowerShell, and schedule it from a build agent or Azure Automation.
Example Azure DevOps audit workflow
- Authenticate to ADO with a PAT or service principal
- Enumerate every project and pipeline in the organization
- Identify pipelines that have not produced a successful build in 90 days
- List self-hosted agents with last-contact time and OS
- Audit service connections, including Azure ones tied to subscription scope
- Export project permissions for the Administrators and Build Administrators groups
- Capture branch policies on the default branch of every repo
- Send the consolidated report to the DevOps and security teams
Final thoughts
Azure DevOps rewards organizations that treat governance as a scheduled task, not a fire drill.
PSForge makes it easy to assemble the right ADO tasks into a single PowerShell workflow you can run on every cadence the business cares about.