Develop a security and compliance plan · Topic 3 of 3
Security and Compliance Scanning
AZ-400 scanning: GitHub Advanced Security, CodeQL, Dependabot, secret and license scanning, Defender for Cloud DevOps security and container scanning.
- 6 min
- GHAS: code scanning (CodeQL), secret scanning with push protection, dependency review. Dependabot: alerts, security updates, version updates.
- GHAS for Azure DevOps works on Azure Repos with pipeline tasks for CodeQL and dependency scanning.
- Defender for Cloud DevOps security connects Azure DevOps, GitHub and GitLab and uses Microsoft Security DevOps for scanning.
What it is
Security scanning automatically checks code, dependencies, secrets, infrastructure definitions and container images for weaknesses. Compliance scanning checks that resources and licenses meet a rule or standard. Running them in the pipeline and on pull requests is DevSecOps: security work happens early, in small pieces, on every change.
How it works
Types of scanning
| Type | Looks for | Typical tools |
|---|---|---|
| Code scanning (SAST) | Insecure patterns in your source, such as injection or weak crypto | CodeQL (GitHub), SonarQube |
| Dependency scanning (SCA) | Known vulnerable packages and their licenses | Dependabot, dependency review, GitHub Advanced Security for Azure DevOps dependency scanning |
| Secret scanning | Keys, tokens and passwords in code | GitHub secret scanning, push protection |
| License scanning | Packages with licenses your policy forbids | Dependency review license checks |
| IaC scanning | Insecure settings in Bicep, ARM, Terraform | Template Analyzer, Terrascan, Checkov |
| Container scanning | Vulnerable packages inside images | Microsoft Defender for Containers, Trivy |
| Dynamic scanning (DAST) | Problems found by attacking a running test app | OWASP ZAP |
GitHub Advanced Security (GHAS) on GitHub
| Feature | What it does |
|---|---|
| Code scanning | Runs CodeQL (or other tools that output SARIF) and shows alerts on pull requests and the Security tab |
| Secret scanning | Detects known secret formats, in the repository and its history. Push protection blocks a push that contains one |
| Dependency review | Shows the vulnerable or disallowed dependencies a pull request adds. The dependency review action can fail the check and enforce license allow or deny lists |
| Dependabot | Alerts for vulnerable dependencies (from the dependency graph and the GitHub Advisory Database), security updates that open fixing pull requests, and version updates driven by dependabot.yml |
Dependabot, secret scanning for public repositories and code scanning for public repositories are free. For private repositories, code scanning and secret scanning belong to the GHAS licensing, billed per active committer.
# .github/dependabot.yml
version: 2
updates:
- package-ecosystem: npm
directory: /
schedule:
interval: weeklyGitHub Advanced Security for Azure DevOps
The same capabilities for Azure Repos Git repositories in Azure DevOps Services: secret scanning with push protection, dependency scanning and code scanning with CodeQL. It is offered as GitHub Secret Protection for Azure DevOps (push protection and secret scanning alerts) and GitHub Code Security for Azure DevOps (dependency alerts and CodeQL scanning), or as the earlier bundled Advanced Security. You enable it at the organization, project or repository level, and it is billed by active committers.
Dependency and code scanning are pipeline based. CodeQL has a default setup, which runs on a schedule and detects the languages for you, and an advanced setup where you add the tasks AdvancedSecurity-Codeql-Init, AdvancedSecurity-Codeql-Autobuild and AdvancedSecurity-Codeql-Analyze, plus AdvancedSecurity-Dependency-Scanning for dependencies. Alerts appear under Repos > Advanced Security, and results can annotate pull requests when a build validation policy runs the scans. Two status checks, AdvancedSecurity/AllHighAndCritical and AdvancedSecurity/NewHighAndCritical, can be added as branch policies to block pull requests that carry critical or high findings.
CodeQL in a container
CodeQL builds a database from your code by observing the build, so the build tools must be present. When a project needs a specific toolchain, run the analyze job inside a container image that includes it by using the job's container: setting. The CodeQL init, build and analyze steps then run inside that container.
Microsoft Defender for Cloud DevOps security
Defender for Cloud gives a single view of DevOps security posture across Azure DevOps, GitHub and GitLab.
- Connect the DevOps environment from Defender for Cloud Environment settings with a connector.
- It shows recommendations on posture (for example, repositories without secret scanning) and findings from code, secrets, dependencies and infrastructure as code.
- Microsoft Security DevOps (MSDO) is a command line tool with an Azure Pipelines task (
MicrosoftSecurityDevOps@1) and a GitHub action. It runs several open source analyzers and writes results in SARIF format that Defender for Cloud and GitHub can display. - Code to cloud mapping links a finding in a repository to the running cloud resource it affects, so teams can prioritize.
- The features require a Defender plan for DevOps posture (part of Defender CSPM).
Integrating GitHub Advanced Security with Defender for Cloud
When a GitHub (or Azure DevOps) environment is connected and GHAS is enabled, Defender for Cloud ingests the GHAS alerts: secret scanning, dependency (Dependabot) and CodeQL findings. Security teams then see them in Defender for Cloud next to cloud recommendations, without opening each repository.
Container scanning
| Stage | Control |
|---|---|
| Build | Scan the image in the pipeline (for example with Trivy through MSDO) and fail on high severity findings |
| Registry | Defender for Containers scans images in Azure Container Registry, on push and continuously, using vulnerability assessment |
| Runtime | Defender for Containers also protects AKS clusters |
| Policy | Only deploy images from approved registries, and use the Evaluate artifact check on environments |
Compliance
- Azure Policy audits or enforces resource rules, and Defender for Cloud shows a regulatory compliance view against standards.
- License compliance uses dependency review with allowed or denied licenses.
- Keep evidence: store scan results and approvals as pipeline artifacts or logs for auditors.
Designing the strategy
- Pull request: secret scanning, push protection, dependency review, fast code scanning.
- Build: SAST, SCA, IaC scanning, container image scan.
- Pre release: DAST against a test environment, compliance checks.
- Runtime: registry scanning, Defender plans, Azure Policy.
- Gates: fail on agreed severities. Warn on lower ones. Track fix times.
A worked scenario
An organization has code in GitHub and Azure DevOps. The security team connects both to Defender for Cloud, enables GHAS and GHAS for Azure DevOps, and turns on push protection. Pipelines run CodeQL and the MSDO IaC analyzers, the container image is scanned before it is pushed to ACR, and Dependabot opens upgrade pull requests every week. A pipeline gate fails the build on high severity vulnerabilities, and Defender for Cloud gives the CISO a single dashboard.
What to remember for the exam
- GHAS: code scanning (CodeQL), secret scanning with push protection, dependency review. Dependabot: alerts, security updates, version updates.
- GHAS for Azure DevOps works on Azure Repos with pipeline tasks for CodeQL and dependency scanning.
- Defender for Cloud DevOps security connects Azure DevOps, GitHub and GitLab and uses Microsoft Security DevOps for scanning.
- GHAS alerts can be surfaced in Defender for Cloud.
- Defender for Containers scans images in ACR. CodeQL can run inside a container job.
"Prevent secrets from being pushed" is push protection. "Update vulnerable packages automatically" is Dependabot security updates.
How the exam asks about this
- "Scan source code for vulnerabilities on every pull request in GitHub." Code scanning with CodeQL.
- "View DevOps security findings from GitHub and Azure DevOps in one place." Defender for Cloud DevOps security.
- "Enforce a list of allowed licenses on pull requests." Dependency review.
- "Scan images in the registry for vulnerabilities." Defender for Containers.
Common mistakes
Scanning only at release. Findings are expensive to fix late.
Failing the build on every low finding. Teams learn to ignore the gate. Choose thresholds.
Forgetting history. Secret scanning finds old leaked secrets, which must still be rotated.
Confusing Dependabot with CodeQL. One handles dependencies, the other your own code.
Check yourself
Which GitHub feature blocks a push that contains a known secret format?
Push protection, part of secret scanning.
Which service connects Azure DevOps, GitHub and GitLab for a single DevOps security view?
Microsoft Defender for Cloud.
Which tool opens pull requests that update vulnerable dependencies?
Dependabot.
Topic 3 of 3 in Develop a security and compliance plan
Test yourself on Develop a security and compliance plan
The full Microsoft AZ-400 question bank has 766 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.