Microsoft Defender for DevOps is a Microsoft Defender for Cloud plan that brings security into the software development lifecycle. It helps organizations shift security left by giving security teams centralized visibility into code, dependencies, secrets, container images, and infrastructure-as-code (IaC) risks before they reach production. section 11.1 section 11.4
The service addresses the gap between developer-focused security tools and security teams responsible for production risk. It can integrate findings from tools such as GitHub Advanced Security into the Defender for Cloud dashboard, where teams can view vulnerabilities, exposed secrets, and misconfigurations from source control systems alongside cloud security work. section 11.4
Its capabilities fall into four practical areas:
- Unified DevOps posture visibility assesses repository configurations and provides hardening guidance for issues such as missing multifactor authentication or failures to follow least privilege. section 11.4.1
- IaC security helps reduce the chance that insecure infrastructure templates and container images are deployed to production. section 11.4
- Code-to-cloud contextualization helps prioritize misconfigurations detected for DevOps resources. section 11.4
- Pull request annotations expose unresolved security findings directly to developers during review. section 11.4
Unified posture visibility starts by onboarding GitHub or Azure DevOps repositories to Defender for Cloud. The portal onboarding wizard creates a security connector, which stores the selected configuration and lets Defender for Cloud connect to the source management system. For GitHub onboarding, use the Defender for Cloud dashboard, choose Environment Settings, add a GitHub environment, then supply a connector name, subscription, resource group, and region. section 11.4.1
Repository hardening workflow
A team onboards its repositories and uses posture assessment to identify weak repository settings. Defender for DevOps then provides best-practice guidance to harden configurations, helping catch issues such as inadequate access controls before deployment-stage security review. section 11.4.1
Table 11.1 A comparison of capabilities available in Defender for DevOps for source code management systems (view table figure)
Compare the available source-code-management findings, including security recommendations, exposed secrets, code scanning, open-source vulnerabilities, and pull request annotation status. section 11.4
