DevSecOps

Confidently build production-ready container images with full end-to-end traceability. With Azure Pipelines for continuous integration and continuous delivery (CI/CD), your code is compiled and packaged into a Docker container on each commit and automatically deployed to a test environment. Trace the commits, work items, and artifacts of every image to understand the code running in your environment.

Use GitHub Actions to automate and run software workflows on any GitHub event like push, issue creation, or a new release. Combine and configure actions for the services you use and save time with matrix workflows that simultaneously test across multiple operating systems. Build, test, and deploy code with support for any language of your choice.

Build, store, secure, scan, replicate, and manage container images and artifacts with Azure Container Registry. Identify vulnerable container images in your CI/CD workflows with automatic scanning using Microsoft Defender for Cloud.

Start with secure configuration of your cloud infrastructure as code (IaC) with Azure Resource Manager (ARM) or other templates to quickly onboard developers with minimal burden. Apply and enforce templatized configurations that ensure consistent security across the organization, paired with Microsoft Defender for Cloud IaC template scanning to minimize cloud misconfigurations reaching production environments.

Deploy your AKS cluster directly from your CI/CD pipeline, using infrastructure-as-code solutions such as Terraform.

Use Azure Policy with AKS to help ensure that operations are compliant.

Securely store and manage keys, certificates, tokens, and other secrets with Azure Key Vault so your applications can load them at run time while avoiding the risk of including keys inside applications' code. Bolster security to FIPS 140-2 Level 2 and Level 3 compliance by importing and generating keys in hardware security modules (HSMs).

Combine with secret scanning from GitHub Advanced Security or GitHub Advanced Security for Azure DevOps to protect against vulnerabilities caused by pushing secrets to code repositories.

Whether you're building an external-facing or internal line-of-business app, use Microsoft Entra ID (formerly Azure AD) to manage identity and access control.

Eliminate the need for managing Azure service principal secrets and other cloud credentials in the GitHub secret store with Microsoft Entra ID (formerly Azure AD) workload identity federation capabilities. Manage all cloud resource access more securely in Azure. These capabilities also minimize the risk of service downtime due to expired credentials in GitHub.

Authenticate users with your organization's directory and rely on advanced security features such as multifactor authentication, Microsoft Entra ID (formerly Azure AD) Identity Protection, and anomalous activity reports.

Help protect access to your Azure resources and the Azure portal with granular role-based access control (RBAC).

Manage access to your business-to-consumer applications for external users with Microsoft Entra ID (formerly Azure AD) B2C.

Monitor your application and infrastructure in real time using Azure Monitor. Identify issues with your code and potentially suspicious activities and anomalies.

Azure Monitor integrates with release pipelines in Azure Pipelines to enable automatic approval of quality gates or release rollback based on monitoring data.

Microsoft Defender for Cloud continually assesses, secures, and defends Azure, on-premises, or multicloud workloads and security postures. Provide full visibility into the DevOps inventory and the security posture of pre-production application code and resource configurations.