TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

Azure DevOps Advanced Security API Access Control

12 posts · Oct 2022 – Aug 2026

What this trail covers

This thread tracks the evolution of Azure DevOps Advanced Security capabilities, focusing on vulnerability detection and remediation. Initially, it covered enabling Privileged Identity Management (PIM) for Project Collection Administrator roles and automated code linting. This post introduces work item linking, allowing users to link work items in Boards directly to security alerts, improving context and visibility for vulnerability tracking and remediation.

All Microsoft trails
  1. Copilot Code Reviews for Azure Repos (public preview)Introduced public preview of GitHub Copilot Code Review for Azure Repos, enabling organization, project, and repository-level enablement. Added support for Managed DevOps Pools. Introduced custom instructions for defining code review standards at organization, project, or repository/path levels. Enabled automatic code reviews via branch policies for pull requests, including draft pull requests. Enhanced billing and cost visibility by including Azure DevOps project tags for Copilot Code Review usage. Announced upcoming features for viewing logs of failed reviews and configurable review levels (Lite and Balanced).
  2. Copilot Autofix for GitHub Advanced Security for Azure DevOpsIntroduces Copilot Autofix for GitHub Advanced Security for Azure DevOps, an AI-powered feature that automatically generates suggested code fixes for CodeQL alerts. The feature integrates directly into the Azure DevOps alert experience, creating pull requests for suggested changes. It supports all CodeQL-supported languages and a curated set of vulnerability classes, with fix generation consuming AI credits billed to the Azure subscription. This closes the gap between vulnerability detection and remediation by automating the creation of suggested fixes.
  3. Copilot Code Reviews for Azure ReposIntroduces Copilot Code Review for Azure Repos pull requests, bringing GitHub Copilot's AI-powered code review capabilities to users who have not yet migrated to GitHub. This feature provides automated comments and suggestions directly within pull requests to improve code quality. It includes setup steps for organization and repository administrators, details the code review process, and outlines preview guardrails and billing information based on GitHub AI credits.
  4. One-click security scanning and org-wide alert triage come to Advanced SecurityIntroduces CodeQL default setup for Azure DevOps, enabling organization-wide code scanning with a single click without manual pipeline configuration. It also adds a combined alerts view in the Security Overview to aggregate and triage security alerts across all repositories, and introduces 'security campaigns' for coordinating remediation efforts.
  5. Temporary rollback: build identities can access Advanced Security: read alerts againThis post announces a temporary rollback of a security restriction that prevented build service identities (e.g., 'Project Collection Build Service') from accessing Advanced Security APIs. The restriction is being re-enforced on May 15, 2026. It recommends migrating automation to a service principal with 'Advanced Security: Read alerts' permissions. It also announces upcoming 'status checks' in Sprint 272, which will provide a native way to gate on security posture at pull request time based on alert presence.
  7. Work item linking for Advanced Security alerts now availableIntroduces work item linking for GitHub Advanced Security for Azure DevOps alerts, enabling users to link work items in Boards directly to security alerts. This improves context and visibility by allowing navigation between alerts and work items, and displaying linked work items in the repository's Advanced Security tab. The feature respects existing permissions.
  8. Hunting Living Secrets: Secret Validity Checks Arrive in GitHub Advanced Security for Azure DevOpsIntroduces secret validity checks to GitHub Advanced Security for Azure DevOps and the standalone Secret Protection experience. This feature queries providers to determine if detected secrets are still active, assigning an 'Active' or 'Unknown' status to alerts. It improves prioritization by allowing users to focus on 'living' secrets and reduces wasted effort on revoked credentials. The post details the workflow, including filtering for active secrets, on-demand verification, and strategies for handling 'Unknown' secrets.
  9. Automate your open-source dependency scanning with Advanced SecurityIntroduced the automatic injection of the dependency scanning task into pipeline runs targeting the default branch. This feature simplifies the enablement of dependency scanning for repositories, ensuring that production code is evaluated for vulnerabilities. The post also details how to configure this feature via repository settings, how results are received (including pull request annotations), and how to skip the injected task using environment variables or pipeline variables. It also mentions ongoing work to improve the enablement process across Advanced Security.
  10. Introducing Pull Request Annotation for CodeQL and Dependency Scanning in GitHub Advanced Security for Azure DevOpsIntroduced Pull Request (PR) Annotation for CodeQL and Dependency Scanning within GitHub Advanced Security for Azure DevOps. This feature automatically scans pull requests for security issues using CodeQL and checks for vulnerabilities in packages/libraries with Dependency Scanning. Found issues are reported directly on the PR interface as annotations, providing developers with immediate feedback on problems and their locations. This aims to improve code quality, streamline development workflows, and integrate security into the CI/CD pipeline.
  11. Now Generally Available: GitHub Advanced Security for Azure DevOps is ready for you to useThis post announces the General Availability of GitHub Advanced Security for Azure DevOps. It details the removal of the registration process, enabling Project Collection Administrators to enable protections directly. It highlights the ability to enable Advanced Security at the org, project, or repo level, with an option for automatic enablement on future repos. The post also mentions the integration with Microsoft Defender for Cloud for unified alert visibility and clarifies billing based on active committers.
  12. Set up PIM access in Azure DevOpsThis post details the technical steps for integrating Azure DevOps with Azure AD Privileged Identity Management (PIM) to manage Project Collection Administrator (PCA) roles. It outlines the creation of an Azure AD security group, enabling PIM for that group, assigning eligible users and approvers, and then mapping this PIM-enabled group to the PCA role within Azure DevOps Organization Settings. The validation steps include activating PIM access as a user and approving the request as an approver, demonstrating the end-to-end workflow for time-bound administrative access.
  13. GitHub Advanced Security for Azure DevOps public preview starts now!Announced the public preview of GitHub Advanced Security for Azure DevOps, integrating GitHub's secret scanning, dependency scanning, and CodeQL code scanning capabilities into Azure Repos and Azure Pipelines. Detailed the functionality of each scanning type, emphasizing secret scanning's push protection to prevent credential exposure before commit, dependency scanning's identification of open-source vulnerabilities, and CodeQL's static analysis for code security vulnerabilities. Outlined the pricing model ($49 per active committer per month) and billing through Azure. Provided links to sign up for the preview and learn more about Azure DevOps investments.
  14. Integrate security into your developer workflow with GitHub Advanced Security for Azure DevOpsThis post announces the upcoming integration of GitHub Advanced Security (Secret Scanning, Dependency Scanning, and CodeQL code scanning) into Azure DevOps, specifically for Azure Repos and Azure Pipelines. It details how these capabilities will be natively integrated, allowing users to find exposed secrets, prevent new exposures, identify open-source package vulnerabilities, and run CodeQL scans directly from Azure Pipelines. It also mentions the integration with Microsoft Defender for Cloud's Defender for DevOps.