Overview

The Agentic Accelerator Framework operates across GitHub and Azure DevOps. Centralized governance requires aggregating security findings from both platforms into unified dashboards. This document covers the data flow architecture, platform-specific capabilities, complementary dashboards, and integration requirements.

Dual-Platform Data Flow

Security findings flow from scan tools through platform-specific pipelines into centralized dashboards. Both paths converge at Microsoft Defender for Cloud for unified visibility.

GitHub Path

flowchart LR
    A[Scan Tools] -->|SARIF Upload| B[GitHub Code Scanning]
    B --> C[GitHub Security Overview]
    B -->|GitHub Connector| D[Defender for Cloud]
    D --> E[Defender for DevOps Console]
    E --> F[Unified Vulnerability Management]

Azure DevOps Path

flowchart LR
    A[Pipeline Tasks] -->|SARIF| B[ADO Advanced Security]
    B --> C[ADO Security Overview UI]
    B -->|ADO Connector| D[Defender for Cloud]
    D --> E[Defender for DevOps Console]
    E --> F[Unified Vulnerability Management]
    B -->|REST API| G["Power BI AdvSec Report"]

Combined Architecture

flowchart TD
    subgraph GitHub
        GH_Scan[Scan Tools] -->|SARIF| GH_CS[Code Scanning]
        GH_CS --> GH_SO[Security Overview]
    end

    subgraph Azure DevOps
        ADO_Pipeline[Pipeline Tasks] -->|SARIF| ADO_AdvSec[Advanced Security]
        ADO_AdvSec --> ADO_SO[Security Overview UI]
        ADO_AdvSec -->|REST API| PBI[Power BI AdvSec Report]
    end

    GH_CS -->|GitHub Connector| MDC[Microsoft Defender for Cloud]
    ADO_AdvSec -->|ADO Connector| MDC
    MDC --> DfD[Defender for DevOps Console]

GitHub Security Overview

GitHub Security Overview provides organization-wide visibility into code scanning alerts across all repositories.

Capabilities

Security Campaigns

Security Campaigns enable bulk remediation of vulnerabilities across an organization:

Copilot Autofix

Copilot Autofix generates fix suggestions directly within code scanning alerts:

ADO Security Overview

ADO Security Overview provides organization-level risk and coverage visibility, though with notable limitations compared to GitHub.

ADO Capabilities

Limitations

These limitations are compensated by the Power BI AdvSec Report (described below), which provides richer analytics through the ADO Advanced Security REST API.

Microsoft Defender for Cloud

Microsoft Defender for Cloud aggregates security findings from both platforms into a unified posture management dashboard.

Defender for Cloud Capabilities

DevOps Security Posture

After connecting GitHub and ADO organizations, Defender for Cloud ingests:

Defender for DevOps Console

The Defender for DevOps console provides a DevOps-specific view within Microsoft Defender for Cloud.

Defender for DevOps Capabilities

Cross-Platform Visibility

Defender for DevOps shows findings from all connected DevOps platforms in a single view, enabling governance teams to compare security posture across organizations that use different source control platforms.

Complementary Dashboards

No single dashboard covers all governance needs. The following five dashboards work together to provide complete visibility.

Dashboard Platform Capabilities Gaps Addressed
GitHub Security Overview GitHub Org-wide alerts, filter by severity/rule/category, Security Campaigns, Copilot Autofix, API access N/A (full-featured for GitHub)
ADO Security Overview ADO Org-level risk and coverage tabs, PR annotations UI-only, no API, limited customization
Power BI AdvSec Report ADO Star schema analytics, DAX measures, multi-org support, trend analysis, Mean Time to Fix Compensates for ADO Security Overview API gap
Defender for Cloud Both Unified cross-platform view, attack path analysis, runtime protection, compliance dashboards N/A (aggregates both platforms)
Defender for DevOps Both DevOps-specific findings across GitHub, ADO, and GitLab N/A (cross-platform DevOps view)

Integration Requirements

GitHub Requirements

Azure DevOps Requirements

Connector Permissions

Power BI AdvSec Report for ADO

The devopsabcs-engineering/advsec-pbi-report-ado repository provides a Power BI report in PBIP format that delivers the analytics capability ADO Security Overview lacks natively.

Architecture

Report Pages

Key Metrics (DAX Measures)

Deployment

# Configure for your ADO organization
.\scripts\setup-parameters.ps1 -OrganizationName "yourorg"

# Open in Power BI Desktop
Start-Process AdvSecReport.pbip

# Automated deployment to Fabric workspace
.\scripts\deploy.ps1

Governance Value

The Power BI report provides “Security Overview at scale” for ADO, enabling governance teams to assess security posture across dozens of projects and repositories. Combined with Defender for Cloud, this creates comprehensive security governance for ADO-hosted repositories that matches the analytical depth available natively on GitHub.

References