Question

Your organization uses Azure DevOps and GitHub across several teams. Security leadership wants a single Azure-based dashboard that surfaces posture recommendations (such as misconfigured pipelines and exposed secrets) from all these repositories and enables mapping findings to Azure workloads. Which approach meets this requirement with the least custom development?

Accepted Answer

Onboard the Azure DevOps and GitHub organizations to Microsoft Defender for Cloud DevOps Security by creating environment connectors, then review the aggregated recommendations in Defender for Cloud.

Answer

Enable GitHub Advanced Security on each GitHub repository and rely on the per-repository Security tab to review findings for the entire organization.

Answer

Configure a scheduled Azure Pipeline that runs open-source scanners and publishes results to a custom Azure Storage account queried by a Power BI report.

Answer

Enable Azure Policy definitions on the subscription so that pipeline and repository misconfigurations are automatically reported in Azure Policy compliance.