Integrate GitHub Advanced Security with Microsoft Defender for Cloud

The division of labour

Integrating them puts a code-level finding and a runtime finding in the same view, attributed to the same workload. That is what lets a security team say "this exposed storage account comes from this template in this repository" instead of raising a ticket that describes a symptom.

Order of operations

1. Enable GHAS (or GHAS for Azure DevOps) so scanning actually happens.
2. Enable the DevOps Security plan in Defender for Cloud.
3. Create the connector for the provider and authorise repository discovery.
4. Findings flow into Defender for Cloud and appear alongside cloud recommendations.

Getting this order wrong is the common support case: a connector is created, inventory appears, and the team concludes the integration is broken when in fact nothing is scanning.

What the integration is not

It does not scan code — GHAS does. It does not remediate — that is Dependabot security updates or a human. It aggregates and correlates, and that is genuinely valuable, but stating it precisely is what the exam rewards.

Primary sources

• https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-devops-introduction
• https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security