Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
| What's New | Developer Community | DevOps Blog | Documentation |
Product roadmap
This feature list is a peek into our roadmap. It identifies some of the significant features we're currently working on and a rough timeframe for when you can expect to see them. It isn't comprehensive but is intended to provide some visibility into key investments. At the top you'll find a list of our large multi-quarter initiatives and the features that they break down into. Further down you'll find the full list of significant features we have planned.
Each feature is linked to an article where you can learn more about a particular item. These features and dates are the current plans and are subject to change. The Timeframe columns reflect when we expect the feature to be available.
Initiatives
Copilot Code Reviews for Azure DevOps (public preview)
Copilot Code Reviews for Azure DevOps brings AI-assisted pull request reviews to Azure Repos. During review, Copilot analyzes pull request changes and posts comments with potential issues and suggested improvements so teams can identify problems earlier and strengthen code quality before merge. The experience is designed for organizations that continue to build on Azure Repos.
To learn more, see Copilot code reviews for Azure Repos.
| Feature | Quarter |
|---|---|
| Copilot Code Reviews for Azure Repos (public preview) |  2026 Q3 |
| Automatically resolve comments when applying suggestions | 2026 Q4 |
| Copilot Code Review configuration changes in the audit log | 2026 Q4 |
GitHub Advanced Security for Azure DevOps
GitHub Advanced Security for Azure DevOps (GHAzDO) brings additional security features to Azure DevOps under an additional license. Any project collection administrator can now enable Advanced Security for their organization, projects and repos from the Project Settings or Organization Settings.
The main capabilities of GitHub Advanced Security for Azure DevOps are:
- Secret Scanning: Detect and remediate plaintext secrets in your git repositories. If push protection is enabled, it also detects and blocks secrets before they are pushed to your repositories.
- Code Scanning: Search for potential security vulnerabilities and coding errors in your code using CodeQL or a third-party tool.
- Dependency Scanning: Detect and alert when your code depends on a package that is insecure and receive straightforward remediation guidance.
You can learn more about how to configure GitHub Advanced Security for Azure DevOps in our documentation.
Upcoming capabilities we expect to deliver include:
| Feature | Quarter |
|---|---|
| Malware alerts for dependency scanning | 2026 Q3 |
| Dependency scanning ecosystem improvements | 2026 Q3 |
| Copilot Autofix for dependency scanning alerts (public preview) | 2026 Q4 |
| Copilot Autofix for code scanning alerts (public preview) | 2026 Q4 |
| CodeQL default setup runs on pull request trigger | 2026 Q4 |
| Support for custom pool selection for Copilot Autofix | 2026 Q4 |
| Batch alert selection for Copilot Autofix | 2026 Q4 |
| Copilot Autofix for Code Security alerts (GA) | 2026 Q4 |
| Code-to-cloud integration with Defender for Cloud | Future |
| AI security detections for non-CodeQL supported languages | Future |
Minimizing the risks associated with credential theft
Azure DevOps supports many different authentication mechanisms, including basic authentication, personal access tokens (PATs), SSH, and Microsoft Entra ID (formerly Azure Active Directory) access tokens. These mechanisms aren't created equally from a security perspective, especially when it comes to the potential for credential theft. For example, unintended leakage of credentials like PATs can let malicious actors into Azure DevOps organizations where they can gain access to critical assets like source code, pivot toward supply chain attacks, or even pivot toward compromising production infrastructure. To minimize the risks of credential theft, we'll focus our efforts in the upcoming quarters in the following areas:
Enable administrators to improve authentication security through control plane policies.
Reducing the need for PATs and other stealable secrets by adding support for more secure alternatives.
Deepening Azure DevOps' integration with Microsoft Entra ID to better support its various security features.
Avoiding the need to store production secrets in Azure Pipelines service connections.
Migrate to Managed DevOps Pools
Managed DevOps Pools is an evolution of Azure DevOps Virtual Machine Scale Set agent pools. It provides better pool scalability and reliability, simplifies pool management, and allows you to use the VM images from Microsoft-hosted agents on custom Azure VMs. You can read more about Managed DevOps Pools here. Features to support new scenarios will be added to Managed DevOps Pools and not Virtual Machine Scale Set pools. Managed DevOps Pools is generally available, so you can migrate your Virtual Machine Scale Set pools to Managed DevOps Pools and use them for production workflows, wherever possible.
You'll find the detailed roadmap here.
YAML and release pipelines feature parity
For the past several years, all our pipelines investments have been in the area of YAML pipelines. Furthermore, all our security improvements have been for YAML pipelines. For example, with YAML pipelines, the control over protected resources (e.g., repositories, service connections, etc.) is in the hands of the resource owners as opposed to pipeline authors. The job access tokens that are used in YAML pipelines are scoped to specific repositories that are specified in the YAML file. These are just two examples of security features that are available for YAML pipelines. For these reasons, we recommend using YAML pipelines over classic. Adoption of YAML over classic has been significant for builds (CI). However, many customers have continued to use classic release management pipelines over YAML for releases (CD). The primary reason for this is the lack of parity in various CD features between the two solutions. Over the past year, we addressed several gaps in this area, notably in Checks. Checks are the primary mechanism in YAML pipelines to gate promotion of a build from one stage to another. We'll continue to address gaps in other areas over the next year. Our focus will be on user experiences, traceability, and environments.
| Feature | Quarter |
|---|---|
| Stage-level traceability | 2027 Q1 |
| On-demand out of order execution of stages | 2027 Q1 |
| Service connections in checks | Future |
| Checks extensibility | Future |
All features
Azure DevOps Services
Azure DevOps Server
How to provide feedback
We would love to hear what you think about these features. Report any problems or suggest a feature through Developer Community.
You can also get advice and your questions answered by the community on Stack Overflow.