TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

Azure Pipelines Supply Chain Security

11 posts · Dec 2012 – Apr 2026

What this trail covers

Azure Pipelines enhances supply chain security by introducing artifact policies that are enforced before deploying to critical environments. These policies, configured as Checks on Environments, leverage Open Policy Agent to evaluate custom rules against deployable artifacts, including container images and Kubernetes resources. Metadata is automatically attributed to artifacts, and deployments are blocked if policies are not met, ensuring that only compliant artifacts are promoted to production. This thread tracks the evolution of Azure DevOps' security capabilities, specifically focusing on integrating GitHub Advanced Security features like CodeQL and Dependency Scanning into the Azure Pipelines CI/CD workflow. The introduction of Pull Request (PR) Annotation allows security insights to be directly presented as annotations within the PR interface, enabling developers to see and fix potential security issues and vulnerabilities in code and dependencies early in the development cycle. This streamlines secure development practices and integrates security seamlessly into the CI/CD pipeline.

All Microsoft trails
  1. Axios npm Supply Chain Compromise – Guidance for Azure Pipelines CustomersThis post provides guidance to Azure Pipelines customers on mitigating the Axios npm supply chain compromise. It clarifies that Azure Pipelines itself was not compromised, but customer workflows using custom scripts, extensions, self-hosted agents, or containers could be at risk if they installed malicious Axios versions. Recommendations include reviewing self-hosted agents, auditing custom/third-party tasks, reviewing service connections, and clearing pipeline dependency caches. It also outlines best practices for reducing future supply chain risk, such as pinning dependency versions, using lockfiles, limiting secret scope, and rebuilding build outputs after remediation. Specific indicators of compromise like network activity to sfrclak[.]com or 142.11.206.73 are provided.
  2. Automate your open-source dependency scanning with Advanced SecurityIntroduces automated injection of the dependency scanning task into Azure Pipelines runs targeting the default branch. This task evaluates open-source dependencies for vulnerabilities. It also enables pull request annotations for dependency scanning findings and integrates with repository build validation policies. Configuration options include enabling 'Scan default branch for vulnerable dependencies' in repository settings or using environment variables like `DependencyScanning.Skip: true` or pipeline variables like `dependencyScanningInjectionEnabled` to control injection.
  3. One Pipeline to Rule Them All: Ensuring CodeQL Scanning Results and Dependency Scanning Results Go to the Intended RepositoryThis post introduces a solution for ensuring CodeQL and Dependency Scanning results are published to the correct repository in Azure DevOps pipelines, particularly in multi-repository scenarios. It details the use of the `advancedsecurity.publish.repository.infer: true` pipeline variable for inferred publishing and the `workspaceRepo: true` setting for explicitly identifying the target repository when multiple repositories are checked out. The post also covers error handling for inferred publishing and provides examples for both CodeQL and Dependency Scanning tasks.
  4. April Patches for Azure DevOps Server and Team Foundation ServerThis post announces April patches for Azure DevOps Server and Team Foundation Server, including a critical update to migrate Azure DevOps Agent downloads from the retiring Edgio CDN to an Akamai-backed CDN. This ensures continued availability of agent binaries by updating the download endpoint from `vstsagentpackage.azureedge.net` to `download.agent.dev.azure.com`. The patches also include security updates for various versions of Azure DevOps Server and Team Foundation Server.
  5. Introducing Pull Request Annotation for CodeQL and Dependency Scanning in GitHub Advanced Security for Azure DevOpsThis post introduces Pull Request (PR) Annotation for CodeQL and Dependency Scanning within GitHub Advanced Security for Azure DevOps. This feature automatically scans code and dependencies during a Pull Request, reporting any found security issues directly as annotations on the PR interface. This provides developers with immediate feedback on potential vulnerabilities, facilitating quicker fixes and more efficient peer reviews, thereby integrating security directly into the development workflow and CI/CD pipeline.
  7. February patches for Azure DevOps ServerThis post details the February patches for Azure DevOps Server, including fixes for a remote code execution vulnerability (CVE-2024-20667) and a bug where the disk space used by the proxy cache folder was calculated incorrectly and not cleaned up. It also provides instructions for verifying the installation of these patches.
  8. Customers using Red Hat Enterprise Linux (RHEL) 6 should upgrade the OS on Self-hosted agentsThis post announces the deprecation of RHEL 6 support for Azure Pipelines agents due to .NET Core 3.1 no longer receiving security patches for this OS. v2.214 will be the last agent version to support RHEL 6. After February 13, future agent releases will not support RHEL 6. A final build (v2.214.2) will be released to notify users. To continue running pipelines on RHEL 6 agents after this date, users must set the AGENT_ACKNOWLEDGE_NO_UPDATES environment variable or pipeline variable to 'true'. This acknowledges the lack of future updates and security patches for the agent on RHEL 6. The post also provides resources for identifying RHEL 6 agents and explains the reasoning behind the deprecation.
  9. Disable creation of classic pipelinesIntroduced a feature to disable the creation of classic build and release pipelines. This feature enhances security by enforcing the use of YAML pipelines, which offer better security through code review, resource access management, and runtime parameters. The feature can be enabled at the organization or project level and impacts UI elements, REST APIs, and the creation of new classic pipelines, task groups, and deployment groups. Existing classic pipelines can still be edited and run.
  10. Deploy Bicep files by using GitHub ActionsThis post demonstrates the integration of Bicep for infrastructure definition and GitHub Actions for CI/CD pipelines to deploy Azure resources. It specifically shows how to provision an Azure Kubernetes Service (AKS) cluster, manage secrets using Azure Key Vault, and deploy containerized applications. The post provides code examples for Bicep templates and GitHub Actions workflows, highlighting the use of encrypted secrets and Azure Key Vault for secure credential management.
  11. Developer Best Practices - Structuring Your Repository for Static Web AppsThis post addresses a security risk in Azure Static Web Apps CI/CD pipelines where the pipeline YAML file could be exposed publicly if deployed from the root of the repository. The author resolves this by moving application files to a 'src' subfolder and updating the pipeline configuration to reference this new location, thereby preventing public access to the YAML file. It also highlights the importance of repository configuration and awareness of external exposure risks.
  12. AzureFunBytes Episode 50 - Intro to @BicepLang with @adotfrankThis post introduces Bicep as a declarative language for Azure infrastructure deployments, highlighting its advantages over ARM templates such as improved syntax, type safety, modularity, and tooling support. It discusses the language design, tooling integration (VS Code extension, playground), and benefits of being Azure-native (day-zero support, no state management with what-if/destroy equivalents, integration with Template Specs and Azure Marketplace). It also provides resources for learning and converting ARM templates to Bicep.
  13. AzureFunBytes - Getting started with BicepThis post introduces Bicep, a Domain Specific Language (DSL) for creating Azure resources, as a transparent abstraction of ARM templates. It covers the Bicep CLI installation, the VS Code plugin, and the use of Azure CLI for deployment. The post demonstrates creating a basic Bicep template and deploying it to Azure, and discusses converting quickstart templates in the Bicep Playground.
  14. Building Your First GitHub ActionThis post introduces the creation of a custom GitHub Action named 'upload-azure-blob' using TypeScript. It details the process of designing the action's inputs and outputs, integrating with Azure Blob Storage via `@azure/storage-blob` and `@azure/identity`, and utilizing the `glob` package for file path matching. The action is intended to be published on the GitHub Marketplace and is designed to work in conjunction with the `azure/login` action for authentication.
  15. Announcing General Availability of YAML CD features in Azure PipelinesThis post announces the general availability of multi-stage YAML CD features in Azure Pipelines. It highlights the unified YAML experience for CI/CD, contrasting it with the visual Releases UI. Key new features include multi-stage YAML pipelines with dependency graphs, resource definitions for artifact traceability and event triggers, environments for deployment targets (Kubernetes, VMs), and approvals/checks on resources like environments and service connections. It also mentions review apps for PR collaboration and a refreshed UX for service connections with enhanced approvals and checks.
  16. Review Apps in Azure PipelinesIntroduced the 'Review Apps' feature in Azure Pipelines, available in public preview, which deploys each pull request (PR) to a dynamically-created Environment resource. This allows teams to preview changes, test in the context of other services, and improve developer productivity and application quality by shifting testing left. The feature is initially supported for Kubernetes and will expand to other Azure services. The workflow involves creating a branch, starting a PR, deploying the PR changes to a Review App, updating the app with subsequent commits, and then merging to staging and production after review and approval.
  17. Secure software supply chain with Azure Pipelines artifact policiesThis post introduces a preview capability for Azure Pipelines that allows users to define and enforce artifact policies before deploying to critical environments. It explains the concept of a software supply chain and how artifact policies can be used to automate the validation of application artifacts. The feature is configured as a 'Check' on an 'Environment' and uses Open Policy Agent for policy evaluation. The post details how metadata is attributed to artifacts and how policies are evaluated against deployable images, halting the pipeline if compliance is not met. It also provides links to documentation for artifact policy checks, custom policy writing, and sample policies.
  18. Integrating Smoke Tests into your Continuous Delivery PipelineThis post details how to integrate smoke tests into a Continuous Delivery (CD) pipeline in Visual Studio Team Services (VSTS) to surface deployment failures early. It explains the use of functional and automated UI smoke tests, demonstrating how to configure the Visual Studio Test task to run tests using various frameworks (MSTest, NUnit, xUnit, Mocha, Jasmine) and technologies like Selenium. It highlights the need for private agents in interactive mode for UI tests or using phantomjs for hosted agents. The post also touches on configuring smoke tests for mobile continuous delivery scenarios using Xamarin.UITests in Xamarin Test Cloud.
  19. Open Source Scanning in Visual Studio Team Services with WhiteSource BoltThis post introduces WhiteSource Bolt, an extension for Visual Studio Team Services (VSTS) that scans for open-source vulnerabilities and license compliance directly within build and release pipelines. It provides reports on vulnerable components and recommended fixes, with a trial mode and integration with Visual Studio Enterprise subscriptions.
  20. Team Services October Extensions Roundup - Rugged DevOpsThis post introduces three new extensions for Azure DevOps that enhance security and license validation for open-source components and code scanning. WhiteSource provides OSS management, real-time vulnerability alerts, and automated approval processes. HPE Security Fortify offers static code analysis (SCA) and on-demand security assessments (static and dynamic). Checkmarx provides static source code analysis with features like incremental scanning and best fix location. These extensions enable 'shifting left' security practices.
  21. CI Experience FuturesThis post details future investments in Azure Pipelines' CI experience. Key areas include: completing parity with XAML builds (label sources, associate work items, gated builds for TFVC), improving build resource management and visibility (agent pooling, access control on build queues), enhancing build quality and test result visibility (front-and-center test failures, richer code coverage reports), improving build extensibility (markdown summaries, VSO App Extensions for build summaries), expanding cross-platform build support (GitHub, Subversion repositories), and refining the overall web-based build experience.
  22. Publishing test results through command line test runnerThis post introduces the TfsPublisher, a logger extension for Visual Studio 2012 Update 1's command-line test runner (vstest.console.exe). It allows publishing test results from the command line to on-premise or hosted TFS builds, enabling cumulative reports from multiple sessions or machines. The post details its installation location, usage with command-line options (Collection, BuildName, TeamProject, Platform, Flavor, RunTitle), and provides examples for publishing with and without code coverage data. It also notes that TfsPublisher only supports publishing for the current test run and not from TRX files.