Lesson245 words
Microsoft Defender for Cloud DevOps Security
Configure Microsoft Defender for Cloud DevOps Security
DevOps Security extends Defender for Cloud from running resources back into the pipelines that create them.
What it gives you
| Capability | Value |
|---|---|
| Connect Azure DevOps, GitHub and GitLab | One inventory of repositories and pipelines across providers |
| Surface code, secret and dependency findings | Security posture visible beside cloud posture |
| Map findings to cloud resources | Trace a misconfiguration back to the IaC template that produced it |
Why the connection matters
Defender for Cloud already knows a storage account is publicly accessible. DevOps Security tells you which template and which repository created it — closing the loop between a runtime finding and the code that must change.
Without it, a cloud security team files a ticket describing a symptom, and a platform team hunts for the cause. With it, the finding names the file.
Setting it up
- Enable the DevOps Security plan in Defender for Cloud.
- Create a connector for each provider (Azure DevOps, GitHub, GitLab).
- Authorise it to discover the organisations and repositories in scope.
- Findings from GitHub Advanced Security surface in Defender for Cloud once integrated.
The prerequisite worth remembering: the scanning itself is done by GitHub Advanced Security (or equivalent). Defender for Cloud is where results are aggregated and correlated with cloud posture — connecting it does not by itself start scanning code.
Primary sources