(Organization) Code Security: existing repositories enrolled
Part of Maester · Azure DevOps · Repositories · All checks
Invoke-Maester -TestId AZDO.1043Overview
Section titled “Overview”Existing Git repositories should be enrolled in the GitHub Code Security plan.
Rationale: Turning on automatic enablement only affects repositories created from that point forward. Every repository that already existed stays unenrolled until it is explicitly onboarded, so an organization can show a correctly configured plan while none of its actual code is scanned. This check assesses real coverage rather than intent.
An unenrolled repository produces no dependency alerts and no code scanning alerts, so vulnerable open source dependencies and code level vulnerabilities in it go unreported.
Remediation action:
Section titled “Remediation action:”Enrol the existing repositories in Code Security. Each option shows an estimate of active committers before billing starts.
All repositories in the organization
- Sign in to your organization.
- Choose Organization settings > Repos > Repositories.
- Select Enable all, then toggle Code Security and the subfeatures you want.
- Select Begin billing to activate the plan for every existing repository in every project.
All repositories in one project
- Choose Project settings > Repos, then open the Settings tab.
- Select Enable all, toggle Code Security, then select Begin billing.
A single repository
- Choose Project settings > Repos > Repositories and select the repository.
- Toggle Code Security, then select Begin billing.
Note that Enable all is a separate action from the automatic enablement toggle covered by AZDO.1042, and must be selected independently.
Results: The first table reports overall coverage. The second breaks the unenrolled repositories down by project, ordered by the size of the gap, so you can see which projects to onboard first.
This check passes only when every Git repository in the organization is enrolled. Any repository without the plan produces no dependency alerts and no code scanning alerts, so partial coverage is reported as a failure rather than being averaged away. An organization part way through a rollout will fail until the remaining repositories are onboarded, and the coverage ratio shows how far along it is.
This test only applies to organizations that use the separate GitHub Secret Protection and GitHub Code Security plans.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1043 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Repositories |
| Area | Engineering systems |
| Resource type | Repository |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1195.001 Compromise Software Dependencies and Development Tools, T1190 Exploit Public-Facing Application |
| Supports controls | nist-800-53-r5:SA-11 |
| PowerShell test | Test-AzdoOrganizationCodeSecurityEnrollment |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops#organization-level-onboarding |