Microsoft Defender for DevOps Integration Guide

Integrate Microsoft Defender for DevOps with Vulnetix. Connect GitHub or Azure DevOps repositories to receive code scanning, secret detection, dependency, and IaC vulnerability findings as SARIF.

Run Microsoft Defender for DevOps in CI

Scan on every push and upload the report as a workflow artifact:

- uses: actions/checkout@v5

- name: Run MSDO
  uses: microsoft/security-devops-action@v1
  id: msdo
  with:
    categories: 'code,secrets,dependencies,IaC'

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: microsoft-security-devops
    path: ${{ steps.msdo.outputs.sarifFile }}
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Microsoft Defender for DevOps's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Microsoft Defender for DevOps. Keep running it. Vulnetix sits on top of Microsoft Defender for DevOps (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Microsoft Defender for DevOps is strongest at its core category and also carries features in SAST, SCA, IaC & Cloud Configuration, Secret Scanning, Container & Image Scanning, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Microsoft Defender for DevOps does well

• Deep native integration with the Microsoft/Azure ecosystem. DevOps findings flow into Defender for Cloud alongside CSPM and workload protection for true code-to-cloud context and remediation prioritisation
• Aggregates GitHub Advanced Security signal (CodeQL SAST, Dependabot SCA, secret scanning) plus MSDO tools (ESLint, Bandit, Terrascan, Template Analyzer) into one unified DevOps security console across GitHub, Azure DevOps and GitLab
• Pull-request annotations and agentless daily code scanning surface issues in-workflow for developers with low pipeline setup
• Enterprise-grade multi-pipeline inventory, posture management and severity/finding-type dashboards backed by Microsoft support

Where Vulnetix adds to it: Defender for DevOps is Microsoft-ecosystem-centric and orchestrates first-party engines (CodeQL, Dependabot, MSDO) into Azure. Vulnetix is scanner- and registry-agnostic: it ingests Defender/GHAS output and layers cross-scanner dedup into one prioritised queue with exploit intel (EPSS, CISA KEV, ESS, LEV), reachability, immutable versioned VEX, SSVC, EOL policy and Safe Harbour autofix PRs, capabilities Defender does not provide natively.

No migration, no rip-and-replace. Microsoft Defender for DevOps keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Microsoft Defender for DevOps results in Vulnetix

Upload Microsoft Defender for DevOps SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Microsoft Defender for DevOps documentation ↗

Wire Microsoft Defender for DevOps into your CI/CD pipeline →