GitHub Advanced Security for Azure DevOps reaches general availability
GitHub has announced the general availability of GitHub Advanced Security (GHAS) for Azure DevOps, bringing its native application security testing tools to the Azure DevOps workflow. The release extends the same code scanning, secret scanning, and dependency review capabilities previously limited to GitHub Enterprise users to Azure DevOps repositories.
GHAS is designed to surface security alerts where developers already work—directly in pull requests. When a code scanning alert is triggered, it appears incrementally during the review process, rather than as a lengthy list of findings after a scan completes. According to GitHub's internal data, this approach yields roughly 80% engagement with surfaced alerts and a 50% real-time fix rate, compared with approximately 16% engagement and 13% fix rates for third-party alerting tools.
Organization-wide enablement and deployment controls
The general availability release adds administrative controls for rolling out GHAS across Azure DevOps. Project Collection Administrators (PCAs) can enable Advanced Security at the organization, project, or individual repository level through Azure DevOps configuration settings. This granularity lets teams phase in security coverage rather than performing a one-time organization-wide deployment.
When enabling GHAS, administrators will see a prompt estimating the number of committers and confirming this is a billable event.
Teams may also configure Advanced Security to automatically enable for all newly created repositories, removing the need to remember to activate security on each new project.
Unified alert visibility with Microsoft Defender for Cloud
For organizations that need an aggregated view of their security posture, GHAS alerts from Azure DevOps repositories can now be viewed in Microsoft Defender for Cloud (MDC) alongside alerts from GitHub repositories. This integration is available in MDC's free tier, giving teams a single dashboard for monitoring findings across both platforms without additional cost.
Getting started
Azure DevOps Project Collection Administrators can enable GitHub Advanced Security protections through Azure DevOps configuration settings. Microsoft has published documentation covering the configuration process. GitHub also plans a webinar on October 4, 2023 at 11 am PT to demonstrate the functionality in action.
