Azure DevOps comes up in two ways in the Safeguard docs. Azure Repos is named as a supported source of code, and Azure DevOps is named as a supported CI/CD pipeline. The docs now have a setup guide for each: an Azure DevOps integration guide for Azure Repos and an Azure Pipelines guide for CI. This post sums both up.
What it is
The ESSCM overview lists source code from GitHub, GitLab, Bitbucket and Azure Repos, and CI/CD pipelines from GitHub Actions, GitLab CI, Jenkins and Azure DevOps. The Azure DevOps integration guide now covers Azure Repos step by step.
How to use it
For repositories, open Integrations, choose the Project/Product tab and click Connect on the Azure DevOps card. If you do not see the card, ask your Safeguard contact; it is switched on per workspace. Public projects go on the Public tab by repository URL. For private repositories choose Private, keep Personal Access Token, enter the organization URL (for example https://dev.azure.com/contoso) and paste a token, then click Check access, choose a project, the repositories and the branch or tag of each, and connect.
Create the token for that one organization with Code (Read) and Project and Team (Read). Add Code (Read & write) only if you want fix pull requests, and Service Hooks (Read, write & manage) only if you want Safeguard to create the push and pull request service hooks for you. Avoid "All accessible organizations" tokens: Microsoft stops global tokens working on 1 December 2026. Only Azure DevOps Services (dev.azure.com) can be connected; Azure DevOps Server is not supported yet, and Microsoft Entra ID sign-in is not available yet.
For pipelines, the Azure Pipelines guide adds one bash step. Create a secret key in Safeguard under Settings, then Developer, with the scopes scans:trigger and scans:read, and add it to the pipeline as a secret variable named SAFEGUARD_API_KEY. The step installs the CLI and runs a scan:
steps:
- checkout: self
- bash: |
set -eu
export SAFEGUARD_INSTALL_DIR="$(Agent.TempDirectory)/safeguard-bin"
curl -fsSL https://cli.safeguard.sh/install | bash
"$SAFEGUARD_INSTALL_DIR/safeguard" ci scan --wait --fail-on critical
displayName: Safeguard scan
env:
SAFEGUARD_API_KEY: $(SAFEGUARD_API_KEY)
Secret variables reach a script only through env, as shown. Pin the CLI by exporting SAFEGUARD_VERSION=<version> before the install line.
What the pipeline does not do
You do not need a marketplace task; the bash step above is the documented route. --fail-on critical fails the run on critical findings. Use --fail-on high (or medium, low) for another threshold, or drop the flag to report only. For Azure Repos, the YAML pr block is ignored, so add a Build validation branch policy on the target branch to scan pull requests.
Quick check
Is there an official Azure DevOps pipeline plugin for the CLI?
You do not need one. The Azure Pipelines guide uses a plain bash step that installs the CLI and runs safeguard ci scan.
