Runs security scanners like Checkov, Terrascan and Template Analyzer as part of a pipeline, either as an Azure DevOps task or a GitHub action. Setting categories: 'IaC' restricts it to the IaC scanners.
Also called MSDO.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Microsoft Security DevOps in context, with comparison tables and the common traps.
Terms in this definition
- Agents (classic) API
First-generation Foundry Agent Service API, based on threads, messages and runs. It is deprecated, replaced by conversations and responses, and retires on 31 March 2027.
- LIKE
Compares strings with a pattern that can contain the % and _ wildcards. Because it only understands character patterns, searching big volumes of text this way is much slower than using full-text search.
- Checkov
Open-source scanner for infrastructure-as-code that Microsoft Security DevOps runs; because it understands Terraform, ARM, Kubernetes manifests, CloudFormation, Helm charts and Dockerfiles, its format coverage exceeds Template Analyzer's.
- Template Analyzer
Bicep and ARM templates are checked by this infrastructure-as-code scanner, which ships with Microsoft Security DevOps and bundles PSRule. Checkov or Terrascan cover Terraform, CloudFormation and Kubernetes files.
- Pipeline
Groups activities logically so that, together, they move and transform data, either one after another or side by side; found in both Azure Data Factory and Microsoft Fabric.
- Azure DevOps
Microsoft's suite of DevOps services, among them Azure Boards and Azure Pipelines.
- IaC
Infrastructure as code means deploying resources from declarative files, for example Bicep or ARM templates.