GitHub Advanced Security for GitHub and Azure DevOps
Configure GitHub Advanced Security for both GitHub and Azure DevOps
GitHub and Azure DevOps expose parallel security products, but their feature names and setup mechanisms are not identical.
| Platform and product | Principal capabilities |
|---|---|
| GitHub Code Security | Code scanning, dependency review, premium Dependabot capabilities, and related code-security features |
| GitHub Secret Protection | Secret scanning, push protection, and related secret-security features |
| GitHub Code Security for Azure DevOps | Code scanning and dependency scanning for Azure Repos |
| GitHub Secret Protection for Azure DevOps | Secret scanning and related secret-protection capabilities for Azure Repos |
Code scanning, secret scanning, and dependency review are valid GitHub capabilities, but they are not an exhaustive definition of GitHub Advanced Security.
Azure DevOps products and repository location
GitHub Advanced Security for Azure DevOps works directly with Azure Repos. Dependency-scanning, code-scanning, and secret-scanning alerts appear in Azure DevOps's Advanced Security tab, so repositories do not need to be migrated or mirrored to GitHub.
Azure DevOps supports enabling its Advanced Security products at organization, project, or repository scope. When both CodeQL and secret scanning are required, select Code Security plus Secret Protection, or the complete Advanced Security suite.
Code-scanning setup by platform
| Platform | Default setup | Advanced setup |
|---|---|---|
| GitHub CodeQL | Managed configuration without a repository workflow file | Editable GitHub Actions workflow for custom controls such as manual builds |
| Azure DevOps CodeQL | Scheduled scanning through Azure Pipelines | CodeQL tasks and build control in the team's Azure Pipeline |
For GitHub, an explicit bespoke build command requires advanced setup with manual build mode. A compiled language alone does not: default setup can use none or autobuild. Running CodeQL in a job container is not container-image scanning, so do not use “container scanning” as a generic setup reason.
Secrets and dependencies
Secret scanning detects exposed credentials already present in repository history. Push protection blocks supported secrets before they reach the repository by default, while configured privileges and policy govern bypass.
On GitHub, dependency review evaluates dependency changes in a pull request and supplies vulnerability and license context. Azure DevOps instead provides pipeline-based dependency scanning, with results aggregated for the Azure Repos repository.
Primary sources
- https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
- https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security
- https://learn.microsoft.com/en-us/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops
- https://learn.microsoft.com/en-us/azure/devops/repos/security/github-advanced-security-security-overview?view=azure-devops
- https://docs.github.com/en/code-security/concepts/code-scanning/setup-types
- https://docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-for-compiled-languages
- https://docs.github.com/en/code-security/concepts/secret-security/push-protection
- https://docs.github.com/en/code-security/concepts/supply-chain-security