Configure the Microsoft Security DevOps Azure DevOps extension

• Project Collection Administrator privileges to the Azure DevOps organization are required to install the extension.

If you don't have access to install the extension, you must request access from your Azure DevOps organization's administrator during the installation process.

To configure the Microsoft Security DevOps Azure DevOps extension:

1. Sign in to Azure DevOps.

2. Navigate to Shopping Bag > Manage extensions.

   

3. Select Shared.

   Note

   If you've already installed the Microsoft Security DevOps extension, it will be listed in the Installed tab.

4. Select Microsoft Security DevOps.

   

5. Select Install.

6. Select the appropriate organization from the dropdown menu.

7. Select Install.

8. Select Proceed to organization.

To configure your pipeline using YAML:

1. Sign into Azure DevOps

2. Select your project.

3. Navigate to Pipelines

4. Select New pipeline.

   

5. Select Azure Repos Git.

   

6. Select the relevant repository.

   

7. Select Starter pipeline.

   

8. Paste the following YAML into the pipeline:

   # Starter pipeline
   # Start with a minimal pipeline that you can customize to build and deploy your code.
   # Add steps that build, run tests, deploy, and more:
   # https://aka.ms/yaml
   trigger: none
   pool:
     # ubuntu-latest also supported.
     vmImage: 'windows-latest'
   steps:
   - task: MicrosoftSecurityDevOps@1
     displayName: 'Microsoft Security DevOps'
     # inputs:    
       # config: string. Optional. A file path to an MSDO configuration file ('*.gdnconfig'). Vist the MSDO GitHub wiki linked below for additional configuration instructions
       # policy: 'azuredevops' | 'microsoft' | 'none'. Optional. The name of a well-known Microsoft policy to determine the tools/checks to run. If no configuration file or list of tools is provided, the policy may instruct MSDO which tools to run. Default: azuredevops.
       # categories: string. Optional. A comma-separated list of analyzer categories to run. Values: 'code', 'artifacts', 'IaC', 'containers'. Example: 'IaC, containers'. Defaults to all.
       # languages: string. Optional. A comma-separated list of languages to analyze. Example: 'javascript,typescript'. Defaults to all.
       # tools: string. Optional. A comma-separated list of analyzer tools to run. Values: 'bandit', 'binskim', 'checkov', 'eslint', 'templateanalyzer', 'terrascan', 'trivy'. Example 'templateanalyzer, trivy'
       # break: boolean. Optional. If true, will fail this build step if any high severity level results are found. Default: false.
       # publish: boolean. Optional. If true, will publish the output SARIF results file to the chosen pipeline artifact. Default: true.
       # artifactName: string. Optional. The name of the pipeline artifact to publish the SARIF result file to. Default: CodeAnalysisLogs*.
     
   

   Note

   The artifactName 'CodeAnalysisLogs' is required for integration with Defender for Cloud. For additional tool configuration options and environment variables, see the Microsoft Security DevOps wiki

9. To commit the pipeline, select Save and run.

   The pipeline will run for a few minutes and save the results.

   Note

   Install the SARIF SAST Scans Tab extension on the Azure DevOps organization in order to ensure that the generated analysis results will be displayed automatically under the Scans tab.

While Defender for Cloud provides the MSDO CLI for standardized functionality and policy controls across a set of open source security analyzers, you have the flexibility to upload results from other third-party security tooling that you might have configured in CI/CD pipelines to Defender for Cloud for comprehensive code-to-cloud contextualization. All results uploaded to Defender for Cloud must be in standard SARIF format.

First, ensure your Azure DevOps repositories are onboarded to Defender for Cloud. After you successfully onboard Defender for Cloud, it continuously monitors the 'CodeAnalysisLogs' artifact for SARIF output.

You can use the 'PublishBuildArtifacts@1' task to ensure SARIF output is published to the correct artifact. For example, if a security analyzer outputs results.sarif, you can configure the following task in your job to ensure results are uploaded to Defender for Cloud: