# (Organization) Code Security: existing repositories enrolled

Existing Git repositories should be enrolled in the GitHub Code Security plan.

Source: https://maester.dev/docs/tests/AZDO.1043

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Repositories · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1043
```

## Overview

Existing Git repositories **should be** enrolled in the GitHub Code Security plan.

Rationale: Turning on automatic enablement only affects repositories created from that point forward. Every repository that already existed stays unenrolled until it is explicitly onboarded, so an organization can show a correctly configured plan while none of its actual code is scanned. This check assesses real coverage rather than intent.

An unenrolled repository produces no dependency alerts and no code scanning alerts, so vulnerable open source dependencies and code level vulnerabilities in it go unreported.

#### Remediation action:
Enrol the existing repositories in Code Security. Each option shows an estimate of active committers before billing starts.

**All repositories in the organization**
1. Sign in to your organization.
2. Choose **Organization settings** > **Repos** > **Repositories**.
3. Select **Enable all**, then toggle **Code Security** and the subfeatures you want.
4. Select **Begin billing** to activate the plan for every existing repository in every project.

**All repositories in one project**
1. Choose **Project settings** > **Repos**, then open the **Settings** tab.
2. Select **Enable all**, toggle **Code Security**, then select **Begin billing**.

**A single repository**
1. Choose **Project settings** > **Repos** > **Repositories** and select the repository.
2. Toggle **Code Security**, then select **Begin billing**.

Note that **Enable all** is a separate action from the automatic enablement toggle covered by AZDO.1042, and must be selected independently.

**Results:**
The first table reports overall coverage. The second breaks the unenrolled repositories down by project, ordered by the size of the gap, so you can see which projects to onboard first.

This check passes only when every Git repository in the organization is enrolled. Any repository without the plan produces no dependency alerts and no code scanning alerts, so partial coverage is reported as a failure rather than being averaged away. An organization part way through a rollout will fail until the remaining repositories are onboarded, and the coverage ratio shows how far along it is.

This test only applies to organizations that use the separate GitHub Secret Protection and GitHub Code Security plans.

#### Related links

* [Learn - Configure GitHub Advanced Security features](https://learn.microsoft.com/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops#organization-level-onboarding)
* [Learn - Set up code scanning](https://learn.microsoft.com/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops#set-up-code-scanning)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1043 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Repositories |
| Area | Engineering systems |
| Resource type | Repository |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1195.001 Compromise Software Dependencies and Development Tools, T1190 Exploit Public-Facing Application |
| Supports controls | nist-800-53-r5:SA-11 |
| PowerShell test | [Test-AzdoOrganizationCodeSecurityEnrollment](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1043.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops#organization-level-onboarding](https://learn.microsoft.com/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops#organization-level-onboarding) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1043.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1043.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1043.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1043.md)