Endor Labs provides an Azure DevOps App that continuously scans Azure repos in your projects for security risks. You can selectively scan your repositories for SCA, secrets, or CI/CD tools.
When you add an Azure DevOps project to an Endor Labs namespace, Endor Labs scans all the Azure repos contained in the project. As a best practice, we recommend that you add only one Azure project to one Endor Labs namespace so that the Azure repos of that project are mapped to an Endor Labs namespace.
Prerequisites for Azure DevOps App
Ensure the following prerequisites are in place before you install the Endor Labs Azure DevOps App.
- An Azure DevOps cloud account and organization. If you don’t have one, create one at Azure DevOps.
- Endor Labs Azure DevOps App requires read permissions to in your project. You can grant these permissions by providing read access to the Code category when you create an Azure DevOps personal access token for Endor Labs.
Install the Azure DevOps App
To automatically scan repositories using the Azure DevOps App:
-
Sign in to Endor Labs.
-
Choose Projects and click Add Project.
-
From AZURE, select Azure DevOps App.
-
Enter the host URL of your Azure project.
The URL must be in the format,
https://dev.azure.com/<ORG_NAME>/<PROJECT_NAME>. -
Enter your personal access token from Azure.
You must have at least read permissions in the Code category for your Azure DevOps personal access token.
-
Click Scanners and select the scan types to enable.
- SCA- Perform software composition analysis.
- Secret - Scan Azure repos for exposed secrets.
- CI/CD - Scan Azure repos and identify all the CI/CD tools used.
The available scan types depend upon your license.
-
Click Create.
Endor Labs Azure DevOps App scans your Azure repos every 24 hours and reports any new findings or changes to release versions of your code.
Manage Azure DevOps Apps on Endor Labs
You can edit or delete the Azure DevOps App integrations.
To edit the Azure DevOps App integration:
- Sign in to Endor Labs.
- Select Manage > Integrations from the left navigation menu.
- Click Manage next to Azure under Source Control Managers.
- Click the ellipsis on the right side, and select Edit Integration.
You can update your personal access token.
- Click SCANNERS and based on your license, select and enable from the available list of scanners.
- Click Save. The changes are applicable from the next scanning cycle.
To delete an Azure DevOps App integration, click the ellipsis on the right side, and select Delete Integration.
To manually trigger a scan, click Rescan Org. Endor Labs Azure DevOps App scans your repositories every 24 hours, use Rescan Org to manually schedule outside the 24-hour period.
Click Scan More Repositories to go to the Projects page, from which you can add more projects to scan through the Azure DevOps App.