One-click security scanning and org-wide alert triage come to Advanced Security
Apr 15, 2026Laura Jiang

Summary
Introduced CodeQL default setup, allowing one-click enablement of code scanning across repositories, projects, or organizations without manual pipeline configuration. Scans run automatically on Azure Pipelines. Also introduced a combined alerts experience in Security Overview for centralized viewing, searching, and filtering of alerts from all repositories, and security campaigns for coordinating remediation efforts on specific vulnerability types or repository sets.
More from the Azure DevOps Service Connection with Microsoft Entra trail
- You can now use the Azure DevOps Service Connection instead of a PAT or Build Session token
- Retirement of Azure DevOps issuer in Workload identity federation service connections
- Optimizing Git policy management at scale
- Azure DevOps MCP Server April Update
- Retirement of Global Personal Access Tokens in Azure DevOps