Edit

GitHub Copilot Code Review for Azure Repos now in public preview

In this sprint, GitHub Copilot Code Review for Azure Repos enters public preview for all Azure DevOps customers. It brings AI-powered feedback directly into pull requests, with flexible enablement, custom instructions, automatic reviews through branch policies, support for Managed DevOps Pools, and improved cost visibility.

Check out the release notes for details.

General

GitHub Advanced Security for Azure DevOps

Azure Boards

Azure Repos

Azure Pipelines

Wiki

General

Remote MCP Server handling rate limits

Tools can now detect when remote MCP Server requests are approaching service rate limits and receive guidance on when to slow down or retry. This helps reduce failed requests and unnecessary retries during periods of high usage.

When a request is rate limited, tool responses now include available retry guidance from Azure DevOps, allowing the calling agent to wait before trying the request again.

Azure DevOps plugin now available in GitHub Copilot app

The Azure DevOps plugin is now available for the GitHub Copilot app. With the plugin, you can view and open your Azure DevOps work items and pull requests, edit work items, and make basic pull request updates and complete pull requests directly from the Copilot app. Install the Azure DevOps plugin from Editor's picks under Customize, then sign in and connect to your Azure DevOps organization and project to get started.

See the blog post announcement to learn more.

GitHub Advanced Security for Azure DevOps

Malware alerts (private preview)

GitHub Advanced Security for Azure DevOps can now surface malware findings as a distinct alert type in repository Dependencies and Security Overview. Security teams can filter, investigate, dismiss, and reopen these findings alongside their existing dependency alerts.

Malware findings displayed as dependency alerts.

To request access for your organization, complete the GitHub Advanced Security for Azure DevOps private preview intake form.

Security overview metrics (private preview)

Risk and coverage pages now include rollup metrics to help security teams understand alert exposure and scanning coverage across their organization. Teams can refine the metrics by project, repository, toolset, severity, period, and coverage state.

Risk:

Risk metrics filtered by project and repository.

Coverage:

Coverage metrics filtered by project and repository.

To request access for your organization, complete the GitHub Advanced Security for Azure DevOps private preview intake form.

Project-level billing for Autofix AI credit usage

Autofix AI credit usage is now attributed to individual Azure DevOps projects. In Azure Cost Management, you can break down Autofix usage and associated costs by project instead of seeing only an organization-level total. This makes it easier to understand and allocate Autofix consumption across your organization.

Azure Boards

Improved security for work item notification emails

We've made a security improvement to Azure DevOps notification emails by disabling clickable links in comments and other large text fields.

Links are still included in the email, but they're no longer clickable. To follow a link, first open the work item in Azure DevOps and then access the link from there. This change helps reduce the risk of phishing and other malicious links being opened directly from notification emails.

Azure Repos

GitHub Copilot Code Review (public preview)

GitHub Copilot Code Review for Azure Repos is now in public preview and available to all Azure DevOps customers, with no early-access signup required. Copilot Code Review brings AI-powered feedback directly into the pull request workflow, helping teams identify issues and apply coding standards more consistently.

GitHub Copilot automatically reviews an Azure Repos pull request.

Before getting started, read the official documentation for details on how Copilot Code Review works, how to enable it, and what to expect around usage and billing.

The public preview also introduces several enhancements based on feedback from the technical preview:

  • Flexible enablement: Enable Copilot Code Review at the organization, project, or individual repository level.
  • Managed DevOps Pools support: Run reviews using a configured Managed DevOps Pool instead of Microsoft-hosted agents.
  • Custom instructions: Define organization, project, repository, or path-specific coding standards for Copilot to consider during reviews.
  • Automatic reviews: Use branch policies to automatically review new pull requests, including draft pull requests.
  • Improved cost visibility: Track Copilot Code Review costs by Azure DevOps project using Azure Cost Management tags and budget alerts.
  • Coming soon: Review failure logs and configurable Lite and Balanced review levels.

Azure DevOps Enterprise Live Migrations (public preview)

Azure DevOps Enterprise Live Migrations is now in public preview. Enterprise Live Migrations helps organizations move repositories from Azure DevOps to GitHub Enterprise Cloud with data residency while minimizing developer disruption through continuous synchronization and a controlled cutover process. It supports migration of repository history, branches, tags, pull request metadata, and branch policies, while enabling teams to continue using Azure Pipelines and Azure Boards during their transition. Learn more about Enterprise Live Migrations.

Azure DevOps Enterprise Live migration in Repos.

Automatic titles for multi-commit pull requests

When creating a pull request with multiple commits, the pull request title is now automatically populated using the source branch name. This provides a useful default instead of leaving the title empty.

The existing Add Commit Messages option remains available for adding commit messages to the pull request description.

Azure Pipelines

Docker socket no longer mapped by default for Linux container jobs

To improve security by following the principle of least privilege, starting with Azure Pipelines agent version 5.279.0, the default value of mapDockerSocket is false for container jobs running on Linux agents. After this change, the host Docker socket (/var/run/docker.sock) isn't mounted into the job container by default on Linux agents.

Note

If your container job runs Docker commands against the host daemon (Docker-in-container), explicitly opt in by setting mapDockerSocket to true on the container resource, or your pipeline fails.

To use the host Docker socket, explicitly opt in by setting mapDockerSocket: true on the container resource.

resources:
	containers:
	- container: my_container
		image: ubuntu:22.04
		mapDockerSocket: true

Container jobs that don't use Docker-in-container behavior require no action. For more information, see Docker socket mapping.

Wiki

Faster wiki search by page title

Searching wiki pages by title is now faster and more responsive, especially for projects with large wikis.

This improvement reduces the time it takes to search a wiki for the first time and speeds up page filtering across the wiki experience, including the page tree, page move dialog, and link autocomplete.

Azure DevOps now retrieves the information needed for page title searches directly from the wiki database, avoiding the need to download and process the full Git tree. If the optimized search data is unavailable, Azure DevOps automatically uses the existing search method.

Next steps

Note

These features will roll out over the next two to three weeks. Go to Azure DevOps and take a look.

Go to Azure DevOps

How to provide feedback

We want to hear what you think about these features. Use the help menu to report a problem or provide a suggestion.

Make a suggestion

You can also get advice and your questions answered by the community on Stack Overflow.

  • Last updated on