Defender for cloud DevOps Security: Is it mandatory to have Github Advanced security enabled to find code vulnerabiltiy in azure devops repos

Question

We are exploring the feature Microsoft Security DevOps and noticed there are no code vulnerability listed in the defender except Iac templates. As per the following table, is it a must have to enable Github Advanced Security to discover code or secret vulnerability ?

For example: I had tested Github advanced security last week (currently disabled) which reported one of the issue, image 1, but now the same code is scanned using MicrosoftSecurityDevOps@1 Defender for Cloud and nothing is listed under code issues as per the new scan in image 2.

https://learn.microsoft.com/en-us/azure/defender-for-cloud/devops-support

Answer 1

Yes to detect code vulnerabilities (SAST, dependency scanning, secret scanning) in Azure DevOps repos via Defender for Cloud’s DevOps Security, you must enable GitHub Advanced Security for Azure DevOps (GHAzDO). Without it, only IaC templates are scanned; code-level vulnerabilities won't appear

Take a look a this additionals feature may insterest you in the future https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!