Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Use the following support information to plan DevOps security capabilities in Microsoft Defender for Cloud.
DevOps security provides visibility into your DevOps environments, helping security teams discover misconfigurations, exposed secrets, and code vulnerabilities in repositories and CI/CD pipelines in Azure DevOps, GitHub, and GitLab.
Cloud and region support
DevOps security is available in the Azure commercial cloud, in these regions:
- Asia (East Asia)
- Australia (Australia East)
- Canada (Canada Central)
- Europe (West Europe, North Europe, Sweden Central)
- UK (UK South)
- US (East US, Central US)
DevOps platform support
DevOps security currently supports the following DevOps platforms:
Note
Defender for DevOps currently doesn't support GitHub Enterprise Cloud instances configured with data residency.
Required permissions
DevOps security requires the following permissions:
| Feature | Permissions |
|---|---|
| Connect DevOps environments to Defender for Cloud |
|
| Review security insights and findings | Security Reader |
| Configure pull request annotations | Subscription Contributor or Owner |
| Install the Microsoft Security DevOps extension in Azure DevOps | Azure DevOps Project Collection Administrator |
| Install the Microsoft Security DevOps action in GitHub | GitHub Write |
Note
To avoid setting highly privileged permissions on a subscription for read access to DevOps security insights and findings, apply the Security Reader role on the resource group or connector scope.
Feature availability
DevOps security capabilities, such as code-to-cloud contextualization, security explorer, attack path analysis, and pull request annotations for Infrastructure-as-Code security findings, are available when you enable the paid Defender Cloud Security Posture Management (Defender CSPM) plan. For a detailed breakdown of posture management capabilities in cloud and DevOps platforms, see DevOps Cloud Security Posture Management.
The following sections summarize the availability and prerequisites for each feature within the supported DevOps platforms.
Agentless code scanning (Preview)
Agentless code scanning (Preview) provides security coverage for repositories connected through Azure DevOps and GitHub. It scans the default branch without requiring changes to CI/CD pipelines or developer workflows. The service identifies code vulnerabilities, Infrastructure-as-Code (IaC) misconfigurations, and open-source dependency vulnerabilities, and generates a queryable software bill of materials (SBOM).
Agentless code scanning supports these capabilities:
- Code vulnerability scanning for Python, JavaScript, TypeScript, JSX, and TSX.
- Dependency vulnerability scanning for package ecosystems such as npm, Yarn, pip, Pipenv, Poetry, Maven, Gradle, NuGet, Go modules, RubyGems, Composer, Cargo, and other ecosystems supported through repository manifests and lockfiles.
- IaC misconfiguration scanning for Terraform, Terraform plan files, AWS CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles, Azure Resource Manager (ARM) templates, Bicep, AWS Serverless Application Model (SAM), Kustomize, Serverless Framework, and OpenAPI specifications.
- SBOM generation to identify dependencies and versions used by repositories.
Agentless code scanning uses the following managed open-source tools:
| Tool | Primary coverage |
|---|---|
| Template Analyzer | ARM and Bicep templates |
| Checkov | Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles, ARM, Bicep, SAM, Kustomize, Serverless Framework, and OpenAPI |
| Bandit | Python code |
| ESLint | JavaScript, TypeScript, JSX, and TSX |
| Trivy | Dependencies and operating system packages in repository manifests and lockfiles |
| Syft | SBOM generation for supported package ecosystems and binaries |
Agentless code scanning runs through Azure DevOps and GitHub connectors. Repository discovery occurs every eight hours, and code and IaC scans run daily. You can select the scanners to run and include or exclude organizations, projects, or repositories. Repositories must be smaller than 1 GB. For setup instructions, supported file types, findings, and limitations, see Configure agentless code scanning.
Azure DevOps
Connect Azure DevOps to Microsoft Defender for Cloud to gain posture management, code scanning, and risk analysis for Azure DevOps organizations and repositories. Learn how to onboard Azure DevOps and review Azure DevOps prerequisites.
GitHub
Connect GitHub to Microsoft Defender for Cloud for inventory discovery, code and IaC vulnerability scanning, and code-to-cloud mapping. Learn how to onboard GitHub and review GitHub prerequisites.
GitLab
Connect GitLab to Microsoft Defender for Cloud for security recommendations and security explorer risk hunting in your GitLab projects. Learn how to onboard GitLab and review GitLab prerequisites.
| Feature | Foundational CSPM | Defender CSPM | Prerequisites |
|---|---|---|---|
| Security recommendations to fix code vulnerabilities | 
|
|
GitLab Ultimate. |
| Security recommendations to fix infrastructure as code (IaC) misconfigurations |
|
|
GitLab Ultimate. |
| Security recommendations to discover exposed secrets |
|
|
GitLab Ultimate. |
| Security recommendations to fix open source vulnerabilities |
|
|
GitLab Ultimate. |
| Attack path analysis | - |
|
Enable Defender CSPM on an Azure subscription, AWS connector, or GCP connector in the same tenant as the DevOps connector. |
| Cloud security explorer | - |
|
Enable Defender CSPM on an Azure subscription, AWS connector, or GCP connector in the same tenant as the DevOps connector. |
External registries
External registry connectors extend Defender for Cloud to container images outside your Azure, AWS, and GCP subscriptions. Foundational CSPM provides inventory. Defender CSPM provides vulnerability assessment and contextual risk signals. For Defender for Containers coverage, see Defender for Containers feature access patterns.
Docker Hub
Connect Docker Hub to Microsoft Defender for Cloud to enable asset inventory and agentless vulnerability assessment for container images in your Docker Hub organization. Learn how to configure vulnerability assessment for Docker Hub and review Docker Hub prerequisites.
| Capability | Foundational CSPM | Defender CSPM | Prerequisites |
|---|---|---|---|
| Inventory discovery of container images in the registry |
|
|
A Docker Hub organization with admin permissions and a read-only access token. Create one connector for each Docker Hub organization. |
| Agentless vulnerability assessment for container images | - |
|
- |
| Code-to-cloud mapping for containers | - |
|
Configure supported code-to-cloud mapping. |
| Code-to-cloud mapping for Infrastructure as Code (IaC) | - |
|
Configure supported code-to-cloud mapping. |
| Attack path analysis | - |
|
- |
| Risk hunting with security explorer | - |
|
- |
| Risk prioritization | - |
|
- |
JFrog Artifactory
Connect JFrog Artifactory to Microsoft Defender for Cloud to enable asset inventory and agentless vulnerability assessment for container images in your JFrog Artifactory Cloud tenant. Learn how to configure vulnerability assessment for JFrog Artifactory and review JFrog Artifactory prerequisites. Defender CSPM adds contextual risk signals to the JFrog Artifactory registry capabilities in this table. The Defender CSPM plan details list broader CSPM capabilities, but only capabilities that support the JFrog connector apply to its registry images.
| Capability | Foundational CSPM | Defender CSPM | Prerequisites |
|---|---|---|---|
| Inventory discovery of container images in the registry |
|
|
A JFrog Artifactory Cloud tenant with administrative access. Create one connector for each tenant. |
| Agentless vulnerability assessment for container images | - |
|
Also requires JFrog CLI and jq JSON parser. |
| Code-to-cloud mapping for containers | - |
|
Configure supported code-to-cloud mapping. |
| Code-to-cloud mapping for Infrastructure as Code (IaC) | - |
|
Configure supported code-to-cloud mapping. |
| Attack path analysis | - |
|
- |
| Risk hunting with security explorer | - |
|
- |
| Risk prioritization | - |
|
- |
For container registry vulnerability assessment and runtime assessment requirements, see Defender for Containers feature access patterns.