Scan Azure DevOps repositories with Mondoo

This is the recommended way to scan an Azure DevOps organization, even if you already run xgrep in a pipeline. Add an Azure DevOps integration and Mondoo discovers every repository in the organization and scans each one, with no pipeline to set up in your repositories. To block pull requests on findings, see When you still need a pipeline.

The integration signs in as a Microsoft Entra app registration. It's the only sign-in method the integration offers.

Before you startCopy Anchor Link

Each part needs the role below. One person can do every part if they hold all three roles.

Azure DevOps authorizes the app through its access level and group memberships, not through Microsoft Entra API permissions.

Part 1: Register the app in Microsoft Entra IDCopy Anchor Link

Requires: permission to register apps in your Microsoft Entra tenant (see Before you start).

1. Sign in to the Microsoft Entra admin center. If you have access to more than one tenant, switch to the tenant that your Azure DevOps organization is connected to.
2. Go to Entra ID > App registrations and select New registration.
3. Enter a Name, for example mondoo-azure-devops. You use this name to find the app in Azure DevOps in Part 2.
4. Under Supported account types, select Single tenant only.
5. Leave Redirect URI empty, and select Register.
6. On the app's Overview page, copy the Directory (tenant) ID and the Application (client) ID.
7. Go to Certificates & secrets > Client secrets and select New client secret.
8. Enter a Description, choose an expiration under Expires, and select Add.
9. Copy the secret's Value now. Microsoft Entra ID shows it only once, and you can't read it again after you leave the page. Don't copy the Secret ID. It isn't the secret.

If someone else does Part 3, give them the tenant ID, the client ID, and the secret value through your organization's secure channel for secrets.

Part 2: Add the app to Azure DevOpsCopy Anchor Link

Requires: membership in the Project Collection Administrators group.

1. In Azure DevOps, go to Organization settings > Users and select Add users.
2. Enter the display name of the app registration from Part 1.
3. Set Access level to Basic. Basic is the lowest access level that includes Azure Repos. Stakeholder doesn't.
4. Select Add. Azure DevOps sends no invitation email to an app.
5. For each project to scan, go to Project settings > Permissions > Readers. On the Members tab, select Add, find the app, and select Save.

The Readers group is read-only, which is all Mondoo needs. Mondoo doesn't discover the repositories of a project that the app isn't a member of.

If Azure DevOps doesn't find the app by name, look up the Object ID of its service principal. In the Microsoft Entra admin center, go to Enterprise applications, open the app, and copy its Object ID. Use that one. Don't use the object ID from App registrations.

Part 3: Add the integration in Mondoo PlatformCopy Anchor Link

Requires: permission to add integrations in the space. The console asks for four values. Each one comes from the earlier parts:

1. In Mondoo Platform, open your organization's Integrations page and choose Azure DevOps.
2. Choose Every repository in the organization.
3. Enter the four values from the table.
4. To limit what Mondoo scans, fill in the optional Allow list and Deny list. Enter one project, or one project/repository, per line. Mondoo scans only what the allow list names, and never scans what the deny list names, even when the allow list includes it.
5. Select the space that receives the repositories. Mondoo adds an asset routing rule that sends the integration's assets to that space. You can refine the rule later under Organization Settings > Asset Routing.
6. Choose the scans to run (see Choose the scans), then select Start Scanning.

To check that it worked, open the integration. Its page lists the repositories Mondoo discovered, and each one shows when its last scan succeeded. If the list is empty or the page shows an error, see Troubleshooting.

Choose the scansCopy Anchor Link

Under Discovery and scan options, each toggle controls one kind of scan:

Mondoo runs the code, secret, and dependency scans with xgrep. If you turn all three off, Mondoo runs no xgrep scan.

Keep the repository list currentCopy Anchor Link

Mondoo discovers the repositories in your organization once a day. To pick up a repository you created a moment ago, open the integration and select Sync repositories. The integration page lists each repository, shows when its last scan succeeded, and has a switch to turn scanning off for a single repository. It also tags repositories that Azure DevOps disabled, repositories that your allow or deny list excludes, and repositories whose last scan failed.

If a repository already has assets from an xgrep pipeline, the integration reuses them. Each repository keeps one asset.

When you still need a pipelineCopy Anchor Link

• To block pull requests on findings, also run xgrep in a pipeline. Each repository keeps one asset.
• Use a pipeline instead of the integration on Azure DevOps Server, when your source code must not leave your network, or when your tenant can't create an app registration.

See Run xgrep in Azure Pipelines.

Rotate the secret or remove accessCopy Anchor Link

Client secrets expire. Rotate the secret before the expiry date you chose in Part 1.

1. In the Microsoft Entra admin center, open the app registration and create a new client secret under Certificates & secrets > Client secrets. Copy its Value.
2. In Mondoo Platform, open the integration and enter the new value as the Client secret.
3. Back in Microsoft Entra ID, delete the old secret.

To remove access, do these in order:

1. In Mondoo Platform, delete the integration.
2. In Azure DevOps, remove the app from the organization under Organization settings > Users. Removing the app registration from Microsoft Entra ID doesn't remove its membership in Azure DevOps.
3. In the Microsoft Entra admin center, delete the app registration.

TroubleshootingCopy Anchor Link

• A 401 error or TF401444: Sign-in required in Mondoo Platform: Add the app to the organization in Organization settings > Users with Basic access, then add it to the Readers group of each project. Also check that the Client secret is the secret's Value, not the Secret ID, and that the secret hasn't expired. Create a new secret if it has.
• Azure DevOps can't find the app when you add it: Search by the app's display name. If that fails, use the Object ID from Enterprise applications, not from App registrations.
• Repository discovery fails in Mondoo Platform: The integration page shows the reason. If the app registration belongs to no project, add it to the Readers group of each project to scan. If Azure DevOps rejected the client secret, update the credential. Then select Sync repositories.

Learn moreCopy Anchor Link

• Azure DevOps Resource Pack Reference
• Scan with cnspec