ado-enum

A command-line tool for enumerating Azure DevOps organisations using a Personal Access Token (PAT). It queries the Azure DevOps REST API to surface projects, repositories, service connections, builds, build artefacts, and security settings — useful during authorised security assessments of ADO environments.

Similar in scope to ADOKit. Key differences: Python implementation which means its more portable, this focuses on read-only enumeration and provides the ability to enumerate permissions.

Azure DevOps enumeration tool — projects, repositories, service connections, and more.

positional arguments:
  {projects,repos,service-endpoints,builds,build-logs,search-code,enumerate,permissions,whoami,pipeline-vars,pipeline-secrets,variable-groups,secure-files,approvals-checks,branch-policies,build-artifacts}
    projects            List projects in the organisation.
    repos               List git repositories in the organisation.
    service-endpoints   Enumerate service connections.
    builds              List builds for projects.
    build-logs          Download build logs.
    search-code         Search for code across repositories.
    enumerate           Enumerate current logged in user, repos, service connections, and projects.
    permissions         List groups, security namespaces, and ACL permissions.
    whoami              Identify the authenticated user and list their group memberships.
    pipeline-vars       List all variables defined in build pipelines.
    pipeline-secrets    List secret variable names defined in build pipelines.
    variable-groups     List variables defined in variable groups.
    secure-files        List secure files registered in projects.
    approvals-checks    Enumerate approvals and checks for protected pipeline resources.
    branch-policies     Enumerate branch policies for a repository.
    build-artifacts     List and download build artifacts.

options:
  -h, --help            show this help message and exit
  --org ORG             Azure DevOps organisation name (e.g. myorg)
  --pat PAT             Personal Access Token. If omitted, reads AZURE_DEVOPS_PAT or ADO_PAT environment variable.
  -k, --insecure        Disable TLS verification (useful with intercepting proxies).

Requirements

Python 3.9+
An Azure DevOps PAT with appropriate read scopes

Installation

From GitHub (recommended)

pip install git+https://github.com/ReversecLabs/azuredevops-enum.git

After installation the ado-enum command is available in your PATH.

Local / development install

git clone https://github.com/ReversecLabs/azuredevops-enum.git
cd ado-enum
pip install .

Or without installing (run directly):

pip install -r requirements.txt
python ado_enum.py --help

Authentication

Provide your PAT via the --pat flag or an environment variable:

export AZURE_DEVOPS_PAT=<your-pat>
# or
export ADO_PAT=<your-pat>

Usage

ado-enum --org <ORG> [--pat <PAT>] [-k] <command> [options]

Commands

`projects` — list projects

ado-enum --org myorg projects
ado-enum --org myorg projects --json

`repos` — list repositories

ado-enum --org myorg repos
ado-enum --org myorg repos --json

`service-endpoints` — enumerate service connections

ado-enum --org myorg service-endpoints
ado-enum --org myorg service-endpoints --project "MyProject"
ado-enum --org myorg service-endpoints --json

`builds` — list builds

ado-enum --org myorg builds
ado-enum --org myorg builds --project "MyProject"

`build-logs` — download build logs

# Download all logs across all projects
ado-enum --org myorg build-logs --output-dir ./logs

# Download logs for a specific build
ado-enum --org myorg build-logs --project "MyProject" --build-id 42 --output-dir ./logs

`search-code` — search code across repositories

Requires the Code Search extension (ms.vss-code-search) to be installed in the organisation.

ado-enum --org myorg search-code "password"
ado-enum --org myorg search-code "connectionString"

Output is JSON with matching file URLs and the lines that matched.

`enumerate` — enumerate branch policies, checks, and permissions

ado-enum --org myorg enumerate
ado-enum --org myorg enumerate --project "MyProject"

Outputs tables for:

Repositories — branch policies (minimum reviewers, comment resolution, etc.)
Service Connections — approvals and checks configured
Permissions — per-identity permissions across Git, Build, Service Endpoint, and Project namespaces

`permissions` — list groups, security namespaces, and ACL permissions

# List all groups and ACL permissions
ado-enum --org myorg permissions

# List groups scoped to a specific project
ado-enum --org myorg permissions --project "MyProject"

# List org-level groups only
ado-enum --org myorg permissions --org-level

# Show groups and permissions for a specific user
ado-enum --org myorg permissions --user "[email protected]"

# Show permissions for a specific group
ado-enum --org myorg permissions --group "Project Administrators"

Requires the PAT to have Graph (read) and Identity (read) scopes for full resolution of group memberships and ACL entries.

`whoami` — identify the authenticated user

ado-enum --org myorg whoami

Reads the x-vss-userdata header to identify the PAT owner, then queries the Graph API to resolve their display name, directory alias, and group memberships.

Requires the PAT to have Graph (read) scope for group membership resolution.

`pipeline-vars` — list pipeline variables

ado-enum --org myorg pipeline-vars
ado-enum --org myorg pipeline-vars --project "MyProject"
ado-enum --org myorg pipeline-vars --json

Lists all non-secret variables defined in build pipeline definitions. Secret variables are excluded; use pipeline-secrets to enumerate those.

`pipeline-secrets` — list pipeline secret variable names

ado-enum --org myorg pipeline-secrets
ado-enum --org myorg pipeline-secrets --project "MyProject"
ado-enum --org myorg pipeline-secrets --json

Lists variables marked isSecret in build pipeline definitions. Values are not exposed by the API and are therefore shown as [HIDDEN]; the command surfaces their names, which pipeline they belong to, and which project they are in.

`variable-groups` — list variable group contents

ado-enum --org myorg variable-groups
ado-enum --org myorg variable-groups --project "MyProject"
ado-enum --org myorg variable-groups --json

Lists all variables stored in variable groups across projects. Secret variables within groups are shown with their names and [HIDDEN] as the value.

`secure-files` — list secure files

ado-enum --org myorg secure-files
ado-enum --org myorg secure-files --project "MyProject"
ado-enum --org myorg secure-files --json

Lists secure files registered in the ADO Pipelines library. File contents are not downloaded; the command returns metadata: file name, ID, who created it, and when.

`approvals-checks` — enumerate approvals and checks for protected resources

# Enumerate all resource types across all projects
ado-enum --org myorg approvals-checks

# Enumerate a specific resource type
ado-enum --org myorg approvals-checks repositories
ado-enum --org myorg approvals-checks service-connections

# Limit to a specific project
ado-enum --org myorg approvals-checks --project "MyProject"
ado-enum --org myorg approvals-checks environments --project "MyProject"

# JSON output
ado-enum --org myorg approvals-checks --json

Supported resource types: agent-pools, environments, repositories, secure-files, service-connections, variable-groups. When no resource type is specified, all types are enumerated.

`branch-policies` — enumerate branch policies for a repository

# List all branch policies for a repository
ado-enum --org myorg branch-policies --project "MyProject" --repository "MyRepo"

# Filter to a specific branch
ado-enum --org myorg branch-policies --project "MyProject" --repository "MyRepo" --branch main

# JSON output
ado-enum --org myorg branch-policies --project "MyProject" --repository "MyRepo" --json

--project and --repository are required. --branch is optional; without it all policies for the repository are returned.

`build-artifacts` — list and download build artefacts

# List all artefacts
ado-enum --org myorg build-artifacts

# Download all artefacts
ado-enum --org myorg build-artifacts --download

# Download all artefacts for a specific build
ado-enum --org myorg build-artifacts --project "MyProject" --build-id 42 --download

# Download a named artefact
ado-enum --org myorg build-artifacts --project "MyProject" --build-id 42 \
  --download --artifact-name "drop" --output-dir ./artefacts

Proxy / proxychains support

Pass -k to disable TLS verification when routing through an intercepting proxy:

proxychains ado-enum --org myorg -k projects

Or set HTTPS_PROXY / HTTP_PROXY environment variables — requests will honour them automatically.

References

ADOKit

`--org`	Organisation name (e.g. `myorg` from `https://dev.azure.com/myorg`)
`--pat`	PAT token (or set `AZURE_DEVOPS_PAT` / `ADO_PAT`)
`-k` / `--insecure`	Disable TLS verification (useful with intercepting proxies)

azuredevops-enum

Most Popular

ado-enum

Requirements

Installation

From GitHub (recommended)

Local / development install

Authentication

Usage

Commands

projects — list projects

repos — list repositories

service-endpoints — enumerate service connections

builds — list builds

build-logs — download build logs

search-code — search code across repositories

enumerate — enumerate branch policies, checks, and permissions

permissions — list groups, security namespaces, and ACL permissions

whoami — identify the authenticated user

pipeline-vars — list pipeline variables

pipeline-secrets — list pipeline secret variable names

variable-groups — list variable group contents

secure-files — list secure files

approvals-checks — enumerate approvals and checks for protected resources

branch-policies — enumerate branch policies for a repository

build-artifacts — list and download build artefacts