Develop a security and compliance plan
Security and Compliance Scanning
CoreCombine distinct code, secret, dependency, license, IaC, container-image, and posture scans and connect findings to runtime context without confusing their coverage.
Aligned to AZ-400 skills measured as of July 27, 2026; guide and product behavior verified September 25, 2026.
Why this matters
No scanner sees every risk. A defensible design identifies what is scanned, when, with which permissions and license, where results appear, and what blocks a release.
Must Know
- Code scanning finds source-level vulnerabilities; secret scanning finds exposed credentials; dependency scanning uses manifests, lock files, graphs, and advisories; license scanning evaluates usage policy.
- Microsoft Defender for Cloud DevOps Security connects supported GitHub and Azure DevOps environments for inventory, posture, recommendations, and code-to-cloud context subject to plan and connector prerequisites.
- GitHub Advanced Security features and GitHub Advanced Security for Azure DevOps have distinct enablement, licensing, permissions, and workflow surfaces.
- The Defender for Cloud integration can correlate GitHub Advanced Security findings with deployed workload context; it does not replace repository scanning.
- Container-image vulnerability scanning evaluates image packages and configuration; CodeQL evaluates source and build flow for supported languages.
- For a compiled build inside a container, CodeQL initialization, build, and analysis must observe the build in the same supported container context.
- Dependabot alerts depend on the dependency graph and advisories; security updates can propose a compatible minimum fixed version when the graph permits it.
Compare and Distinguish
- CodeQL code scanning is not container image package scanning.
- Dependabot alert identifies a vulnerable dependency; a security update proposes a change; dependency review evaluates pull-request dependency changes.
- Defender for Cloud adds centralized and runtime context; repository security tools produce the underlying development findings.
Scenario examples
- Scenario: CodeQL sees no compiled source in a container build. Think: initialize, build, and analyze inside the same job container.
- Scenario: Security wants production exposure context on a code finding. Think: integrate repository findings with Defender for Cloud code-to-runtime mapping.
Exam traps
- A container image scan does not prove custom source code is free of injection flaws.
- Dependabot cannot alert on dependency data absent from a supported manifest, lock file, or submitted graph.
- Connecting a DevOps organization does not automatically enable every paid scanning feature.
Key takeaways
- Map each risk class to a scanner and enforcement point.
- Preserve repository findings and add runtime context rather than replacing either view.
- Verify licenses, permissions, supported platforms, and data flow before promising coverage.
How it works
- Repository scanners analyze source and dependency changes, publish findings, and expose status that branch protection can require.
- DevOps posture connectors ingest supported findings and relate repositories to cloud resources when mapping evidence exists.
Objects and administrative surfaces
- GitHub Security settings, CodeQL workflows, secret protection, dependency graph, Dependabot, dependency review, and security overview.
- Azure DevOps Advanced Security settings and scanning tasks.
- Defender for Cloud DevOps connectors, inventory, recommendations, posture, and GitHub Advanced Security integration.
When to use it
- Use both source analysis and image scanning when an application is compiled inside a container and ships as a container image.
Security and governance implications
- Define severity gates, dismissal authority, exception expiry, repository rollout scope, and finding ownership before enforcing scans.
Troubleshooting signals
- For an empty CodeQL result, verify language selection, initialization order, build mode, container boundary, source path, and analysis upload.
More detail
- Enable GitHub Advanced Security capabilities at the intended GitHub or Azure DevOps scope and configure the corresponding workflows.
- Run CodeQL initialization, compiled build, and analysis in a compatible execution context so compiled code is observed.
- Use dependency graphs and Dependabot alerts to identify vulnerable direct or transitive components and available fixed versions.
Ready for the quiz?
- Why are image scanning and CodeQL complementary?
- What enables Dependabot alerts for a repository?
- What does Defender for Cloud add to Advanced Security findings?
Related objectives
- D4.3.S1 — Design a strategy for security and compliance scanning, including dependency, code, secret, and licensing scanning
- D4.3.S2 — Configure Microsoft Defender for Cloud DevOps Security
- D4.3.S3 — Configure GitHub Advanced Security for GitHub and GitHub Advanced Security for Azure DevOps
- D4.3.S4 — Integrate GitHub Advanced Security with Microsoft Defender for Cloud
- D4.3.S5 — Automate container scanning, including scanning container images and configuring an action to run CodeQL analysis in a container
- D4.3.S6 — Automate analysis of vulnerabilities of open-source components by using Dependabot alerts