//Azure DevOps - Security Testing Guide (Ado-STG)/Pipeline Access Control
| ID: | AdoSTG-PAC-02, AdoSTG-PAC-03 |
Approval gates in ADO are a set of features allowing for control over workflows defined in pipelines. Approval gates set the conditions for how and if a pipeline/job is allowed to execute. Various conditions can be specified, such as time of day or number of approvers. These gates and approvals can be specified along various parts of the CI/CD process; namely, they can be set for different phases of the deployment, such as before the pipeline is run or after. From a security perspective, what we are most concerned about here is that approval gates are configured such that a single compromised user cannot make changes to code and trigger a deployment.
To verify the configuration of pipelines, you need to inspect each project individually. Under "Pipelines" > "Environments," you will find the approver settings under each environment.
For each of these, check the following
Ensure that pipelines are configured to require a minimum of 2 approvers, and ensure that the users who request approval cannot approve their own requests.
