Skip to main content
{ Reporting and Compliance / Vulnerability Management }

Azure DevOps Advanced Security Posture Report

Delivers a weekly report on Advanced Security coverage across an Azure DevOps organization, what changed, and anything that needs attention.

What this agent does

This read-only agent checks the health of Advanced Security across an Azure DevOps organization every week. It finds active repositories where Secret Protection or Code Security is off, where push protection is off, and where neither a default setup nor a pipeline task runs dependency scanning or CodeQL. It counts the pushes that bypassed push protection. It summarizes the alerts that appeared, were closed, or were dismissed since last week. It flags anything that needs an admin, such as a scanning task that fails in every run or an active committer count close to the budget.

The challenge

Advanced Security only covers repositories where it is enabled and where something runs the scans, and those settings change over time. A new repository starts with it off because nobody turned on the auto-enable option. A pipeline drops the dependency scanning task during a refactor. A developer bypasses push protection with a commit message flag and the secret lands anyway. Admins find out when an auditor reports an old vulnerability.

The solution

The agent checks enablement, scanning setup, push protection, bypasses, and alert activity across the organization in one pass each week and compares them with the previous week. It lists what changed and what someone needs to act on, with the fix for each item. Provides a weekly briefing an admin can read in a few minutes.

Workflow

  1. 01

    Check enablement

    Find active repositories where Secret Protection, Code Security, or push protection is off, and read the auto-enable settings for new repositories and projects.

  2. 02

    Check scanning

    Find repositories where neither default setup nor a pipeline task runs dependency scanning or CodeQL, and tasks that failed in every run this week.

  3. 03

    Check activity

    Count push protection bypasses, and summarize alerts that appeared, were closed, or were dismissed since last week, with who dismissed them and why.

  4. 04

    Report

    Publish what changed and what needs action, with the fix for each item.

Agent template 

# Azure DevOps Advanced Security Posture Report

## Measurable outcomes

Every week, the admin knows which repositories Advanced Security is not covering, what changed across the organization, and what needs action. Track covered and uncovered repositories and open action items on every run.

## Procedure

Once a week, read the Advanced Security enablement at the organization level and at each project, and check every active repository across the organization's projects. An organization on the bundled plan has one enablement state per repository. An organization on the standalone plans has Secret Protection and Code Security as separate states, so check each one. List the repositories where Secret Protection is off and the repositories where Code Security is off. List the repositories where push protection is off. Flag each project and the organization where the option to enable Advanced Security automatically on new repositories or new projects is off. For each repository with Code Security, dependency scanning counts as running when the repository's default setup for vulnerable dependencies is on or when a pipeline that builds from it runs the dependency scanning task. CodeQL counts as running when the repository's CodeQL default setup is on or when a pipeline runs the CodeQL analyze task. List each repository missing either, and name the missing one. List the scanning tasks that failed in every run this week, with the error. Count the commits pushed since last week whose message carries the push protection skip flag, by repository, and list the secret alerts those pushes created. Summarize the new Critical and High alerts, the alerts closed, and the alerts dismissed since the last report, with who dismissed them and the dismissal reason and comment. Flag dismissals with no comment. Compare the active committer count for each plan with the budget I set, and flag anything above 80 percent. Compare everything with last week's report, and lead with what changed. Give every action item the specific fix. Report a check it cannot run as not checked, never as fine.

## Requirements

It needs Azure DevOps read access to the organization's projects, repositories, commits, Advanced Security enablement, alerts, and active committer counts, and pipeline definitions and runs, through a personal access token with the Project and Team (Read), Code (Read), Build (Read), and Advanced Security (Read) scopes, and nothing more. It never changes enablement, repository settings, pipelines, or alerts.