GitHub Advanced Security for Azure DevOps adds GitHub Advanced Security's suite of security features to Azure Repos.

GitHub Advanced Security for Azure includes:

• Secret Scanning push protection: check if code pushes include commits that expose secrets such as credentials
• Secret Scanning repo scanning: scan your repository and look for exposed secrets that were committed accidentally
• Dependency Scanning ? search for known vulnerabilities in open source dependencies (direct and transitive)
• Code Scanning ? use CodeQL static analysis engine to identify code-level application vulnerabilities such as SQL injection and authentication bypass

At this time, GitHub Advanced Security for Azure DevOps is only available for Azure DevOps Services and there are no plans to bring this product to Azure DevOps Server.

[!INCLUDE GitHub Advanced Security for Azure DevOps is different from GitHub Advanced Security. ]

You must have permissions allocated as a member of the Project Collection Administrators group. To add members to the Project Collection Administrators group or change a project collection-level permission see Change project collection-level permissions .

If your organization uses self-hosted agents, there are more requirements:

• Add these URLs to your Allowlist to allow for the dependency scanning task to fetch vulnerability advisory data. Learn more about Allowed IP addresses and domain URLs .

• Run a compatible version of the .NET runtime (currently .NET 6.0.x). If a compatible version isn't present on the agent, the dependency scanning build task downloads .NET .

• Install the CodeQL bundle to the agent tool cache by utilizing the setup script for your architecture, available on GitHub . These scripts require the $AGENT_TOOLSDIRECTORY environment variable to be set to the location of the agent tools directory on the agent, e.g. C:/agent/_work/_tool . Alternatively, you may manually implement the following steps:

  1. Pick the latest CodeQL release bundle from GitHub .
  2. Download and unzip the bundle to the following directory inside the?agent tool directory, typically located under _work/_tool : ./CodeQL/0.0.0-[codeql-release-bundle-tag]/x64/ . Using the current release of v2.16.0 , the folder name would be titled ./CodeQL/0.0.0-codeql-bundle-v2.16.0/x64/ . Learn more about the agent tool directory .
  3. Create an empty file titled x64.complete within the ./CodeQL/0.0.0-[codeql-release-bundle-tag] folder. Using the previous example, the end file path to your x64.complete file should be ./CodeQL/0.0.0-codeql-bundle-v2.16.0/x64.complete .

You can enable Advanced Security at the organization, project, or repository level. To access each of the scanning tools and results, you need to first enable Advanced Security. Once you enable Advanced Security, any future pushes containing secrets to a repository with this policy enabled are blocked, and repository secret scanning happens in the background.

1. Go to your Project settings for your Azure DevOps project.
2. Select Repos > Repositories .
3. Select the repository you want to enable Advanced Security for.
4. Select Enable and Begin billing to activate Advanced Security . A shield icon now appears in the repository view for any repository with Advanced Security enabled.

:::image type="content" source="media/enable-github-advanced-security.png" lightbox="media/enable-github-advanced-security.png" alt-text="Screenshot of enabling GitHub Advanced Security.":::

1. Go to your Project settings for your Azure DevOps project.
2. Select Repos .
3. Select the Settings tab.
4. Select Enable all and you'll see an estimate for the number of active committers for your project appear.
5. Select Begin billing to activate Advanced Security for every existing repository in your project.
6. Optionally, select Automatically enable Advanced Security for new repositories so that any newly created repositories have Advanced Security enabled upon creation.

:::image type="content" source="media/enable-github-advanced-security-project.png" lightbox="media/enable-github-advanced-security-project.png" alt-text="Screenshot of project-level enablement for Advanced Security.":::

1. Go to your Organization settings for your Azure DevOps organization.
2. Select Repositories .
3. Select Enable all and you'll see an estimate for the number of active committers for your organization appear.
4. Select Begin billing to activate Advanced Security for every existing repository in each project in your organization.
5. Optionally, select Automatically enable Advanced Security for new repositories so that any newly created projects have Advanced Security enabled upon creation.

:::image type="content" source="media/enable-github-advanced-security-organization.png" lightbox="media/enable-github-advanced-security-organization.png" alt-text="Screenshot of org-level enablement for Advanced Security.":::

Secret scanning push protection and repository scanning are automatically enabled when you turn on Advanced Security. You can enable or disable secret push protection from the repository settings page.

:::image type="content" source="media/secret-scanning-push-protection.png" lightbox="media/secret-scanning-push-protection.png" alt-text="Screenshot of enabling push protection.":::

As mentioned, secret scanning repository scanning is automatically kicked off upon enabling Advanced Security for a selected repository.

Dependency scanning is a pipeline-based scanning tool. Results are aggregated per repository. It's recommended that you add the dependency scanning task to all the pipelines you'd like to be scanned.

Add the task Advanced Security Dependency Scanning task ( AdvancedSecurity-Dependency-Scanning@1 ) directly to your YAML pipeline file or select the Advanced Security Dependency Scanning task from the task assistant .

:::image type="content" source="media/dependency-scanning-config-yaml.png" lightbox="media/dependency-scanning-config-yaml.png" alt-text="Screenshot of dependency scanning pipeline setup for YAML.":::

Add the Advanced Security Dependency Scanning task to your pipeline.

:::image type="content" source="media/dependency-scanning-config-classic.png" lightbox="media/dependency-scanning-config-classic.png" alt-text="Screenshot of dependency scanning pipeline setup for classic pipelines.":::

To generate alerts, run your first scan with a pipeline with the dependency scanning task included.

Code scanning is also a pipeline-based scanning tool where results are aggregated per repository.

Add the tasks in the following order:

1. Advanced Security Initialize CodeQL ( AdvancedSecurity-Codeql-Init@1 )
2. Your custom build steps
3. Advanced Security Perform CodeQL Analysis ( AdvancedSecurity-Codeql-Analyze@1 )

:::image type="content" source="media/code-scanning-config-yaml-tasks.png" lightbox="media/code-scanning-config-yaml-tasks.png" alt-text="Screenshot of code scanning pipeline setup for YAML.":::

Additionally, you'll need to specify which language(s) you're analyzing in the Initialize CodeQL task. A comma separated list can be used to analyze multiple languages at once. The supported languages are csharp, cpp, go, java, javascript, python, ruby, swift .

Here is an example starter pipeline:

[!div class="tabbedCodeSnippets"]

trigger
:
  - 
main


pool
:
  
#
 Additional hosted image options are available: https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/hosted#software

  vmImage
: 
ubuntu-latest


steps
:

  - 
task
: 
AdvancedSecurity-Codeql-Init@1

    inputs
:
      
languages
: 
"
java
"

      #
 Supported languages: csharp, cpp, go, java, javascript, python, ruby, swift

      #
 You can customize the initialize task: https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/advanced-security-codeql-init-v1?view=azure-pipelines


#
   Add your custom build steps here

#
 - Ensure that all code to be scanned is compiled (often using a `clean` command to ensure you are building from a clean state).

#
 - Disable the use of any build caching mechanisms as this can interfere with CodeQL's ability to capture all the necessary data during the build.

#
 - Disable the use of any distributed/multithreaded/incremental builds as CodeQL needs to monitor executions of the compiler to construct an accurate representation of the application.

#
 - For dependency scanning, ensure you have a package restore step for more accurate results.


#
 If you had a Maven app:

#
   - task: Maven@4

#
     inputs:

#
       mavenPomFile: 'pom.xml'

#
       goals: 'clean package'

#
       publishJUnitResults: true

#
       testResultsFiles: '**/TEST-*.xml'

#
       javaHomeOption: 'JDKVersion'

#
       jdkVersionOption: '1.17'

#
       mavenVersionOption: 'Default'


#
 Or a general script:

#
   - script: |

#
       echo "Run, Build Application using script"

#
       ./location_of_script_within_repo/buildscript.sh


  - 
task
: 
AdvancedSecurity-Dependency-Scanning@1 
#
 More details on this task: https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/advanced-security-dependency-scanning-v1?view=azure-pipelines


  - 
task
: 
AdvancedSecurity-Codeql-Analyze@1 
#
 More details on this task: https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/advanced-security-codeql-analyze-v1?view=azure-pipelines

If the language specified is cpp, java, csharp or swift either custom or AutoBuild build steps are required. For other languages, if AutoBuild is included the step completes successfully without performing any action.

Add the tasks in the following order:

1. Advanced Security Initialize CodeQL
2. Advanced Security AutoBuild (language-dependent) or replace this with your own custom build steps
3. Advanced Security Perform CodeQL Analysis

:::image type="content" source="media/code-scanning-config-classic-tasks.png" alt-text="Screenshot of code scanning pipeline setup for YAML." lightbox="media/code-scanning-config-classic-tasks.png" :::

Additionally, you will need to specify which language(s) you are analyzing in the Initialize CodeQL task. If the language specified is cpp, java, csharp or swift, either custom or AutoBuild build steps are required. For other languages, if AutoBuild is included the step completes successfully without performing any action.

To generate alerts, run your first scan with a pipeline with the code scanning tasks included.

If, for whatever reason, you need to disable Advanced Security, any alerts and state of alerts will be retained for the next time you re-enable Advanced Security for your repository.

• Code scanning alerts for GitHub Advanced Security for Azure DevOps
• Dependency scanning alerts for GitHub Advanced Security for Azure DevOps
• Secret scanning alerts for GitHub Advanced Security for Azure DevOps
• Permissions for GitHub Advanced Security for Azure DevOps
• Billing for GitHub Advanced Security for Azure DevOps