Question

Your organization has onboarded all Azure DevOps repositories to Microsoft Defender for Cloud DevOps security using the Azure DevOps connector. A security recommendation reports that a repository contains an exposed Azure Storage account key committed in a configuration file six months ago. You must remediate the finding so that the credential can no longer be used, while ensuring future commits are blocked from introducing the same type of secret before they reach the default branch. Which combination of actions should you take?

Accepted Answer

Rotate (regenerate) the exposed storage account key in Azure, then enable push protection in GitHub Advanced Security for Azure DevOps secret scanning on the repository.

Answer

Delete the file from the latest commit only, then rely on the Defender for Cloud recommendation to automatically block future commits containing secrets.

Answer

Rewrite Git history with a filter to purge the key from all commits, then add a .gitignore entry for the configuration file so it is never committed again.

Answer

Move the storage account key into an Azure DevOps variable group and mark the variable as secret, which prevents Defender from flagging it in future scans.