Allow only administrators to create feeds in your organization.
Allowing every project member to create Azure Artifacts feeds quickly fragments your package supply chain. Untracked feeds bypass the curation, retention, and upstream-source controls that a small set of feed administrators would normally enforce, which makes it far easier for a typosquatted or malicious package to enter a build. Because feed sprawl is rarely audited, a compromised or low-reputation upstream can persist for months before anyone notices, expanding the blast radius of a single bad dependency across many pipelines.
In Organization Settings > Artifacts, the 'Feed creators' role is left at its permissive default so any contributor can create a new feed. A developer creates a personal feed, adds a public upstream source with no allow-list, and points a release pipeline at it. The feed never appears in any inventory the security team reviews.
Restrict feed creation to a named group of feed administrators, then require all new feeds to be requested through that group so each one is reviewed for upstream sources and retention before it is used by a pipeline. Periodically reconcile the live feed list against your approved inventory and remove orphaned feeds. DevOps Shield flags this control automatically and shows which organizations still permit open feed creation.
This control is specific to Azure DevOps Artifacts. The equivalent risk on GitHub is governed through GitHub Packages permissions and on GitLab through the Package Registry visibility settings, so the same intent maps to different settings per provider. The 'Feed creators' role is configured at the organization level and is distinct from per-feed permissions, which still need to be tightened separately.
# Inspect who can currently create feeds (requires the azure-devops CLI extension)
az devops configure --defaults organization=https://dev.azure.com/<your-org>
az artifacts universal --help # confirm the extension is available
# List existing feeds so you can reconcile against your approved inventory
az artifacts feed list --organization https://dev.azure.com/<your-org> --output table1. Go to Artifacts. 2. Click on Azure Artifacts Settings button. 3. Review 'Who can create feeds' and select 'Only administrators and these users can create feeds'. Grant this permission to a limited set of users/groups.
{
"target": "ADOArtifactSettingsGlobalPermissions",
"if": {
"allOf": [
{
"resource": "ADOArtifactSettingsGlobalPermissions",
"property": "OnlyAdministratorRole",
"operator": "equals",
"value": true
}
]
},
"then": {
"effect": "Audit"
}
}Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions | v1.0.9