Discover and inventory source code repositories across all platforms
Implementation Effort: Medium – Enumerating repositories across GitHub, Azure DevOps, GitLab, and self-managed servers and reconciling them against identity and billing signals is a multi-step effort across security and platform teams. User Impact: Low – Building and maintaining the repository inventory is an administrative discovery activity; end users are not affected. Lifecycle Stage: Govern
Overview
Discover and maintain an inventory of every source code repository the organization owns, across all developer platforms, so that downstream security controls can be applied to a known and complete set of repositories rather than only the ones a central team happens to know about. Repository discovery is the foundation of the source code security swimlane: a control that is not applied to a repository protects nothing, and the repositories most likely to be missed — shadow projects, team-created organizations, acquired codebases, and self-managed servers — are precisely where ungoverned risk accumulates.
Most organizations hold code in more than one place. Alongside the primary GitHub or Azure DevOps estate, there are frequently GitLab groups, repositories inherited through acquisition, personal or team accounts that were never folded into the enterprise, and self-managed Git servers. Build the inventory from every source you can enumerate: GitHub organization and enterprise repository listings, Azure DevOps project and repository APIs, GitLab group and project listings, and Microsoft Defender for Cloud DevOps inventory across connected environments. Reconcile the result against identity and billing signals (Microsoft Entra ID, platform billing, network egress to known SCM hosts) to surface repositories hosted on platforms no one has formally onboarded. Record each repository with its platform, owning team, business criticality, and whether it is in scope for the organization's security controls, and keep the inventory current as projects are created and retired. This repository inventory is the source-code-level complement to the broader DevOps asset registry and feeds the posture-coverage onboarding model there.
Platform coverage and applicable controls
The pillar provides first-party guidance for the three source platforms that Microsoft Defender for Cloud DevOps security supports as connectors — GitHub, Azure DevOps, and GitLab — and the depth of available controls differs by platform.
GitHub offers the richest control set: GitHub Advanced Security (CodeQL code scanning, secret scanning with push protection, Dependabot and dependency review), Microsoft Defender for Cloud posture management and code-to-cloud mapping through the GitHub connector, and the Microsoft Defender and GitHub Code Security integration. Agentic AI vulnerability discovery (MDASH) currently targets GitHub-hosted code through GitHub Code Security and its Defender integration. On Azure DevOps, GitHub Advanced Security for Azure DevOps (GHAzDO) delivers the same code scanning, secret scanning, and dependency scanning capabilities, alongside Defender for Cloud posture management through the Azure DevOps connector. For GitLab, Microsoft Defender for Cloud provides DevOps posture management, code-to-cloud context, and surfacing of code, secret, dependency, and IaC findings through the GitLab connector (generally available; requires a GitLab Ultimate license for the group); the GitHub Advanced Security feature set — CodeQL and GitHub secret scanning (on GitHub and Azure DevOps) and MDASH (on GitHub) — is not available on GitLab, so on GitLab rely on Defender for Cloud posture together with GitLab's native security scanning rather than assuming GHAS parity.
Source platforms without a first-party Defender for Cloud connector — for example Bitbucket or self-managed Git servers — are not covered by the connector-based controls in this pillar. For those, either bring the code into a supported platform, apply the platform's native and third-party scanning equivalents, and govern access through Microsoft Entra ID, or make an explicit, documented decision to scope them out. The inventory is what makes that decision deliberate rather than accidental.
Without a complete cross-platform repository inventory, an organization cannot state what fraction of its code is scanned, governed, or onboarded to Defender for Cloud, and repositories on unmanaged platforms remain invisible to every control the pillar describes. Establishing discovery first ensures that branch protection, code scanning, secret scanning, dependency management, and posture coverage are measured against the full estate rather than a convenient subset.
A complete inventory underpins the Verify explicitly principle: security controls can only validate the repositories the organization knows about, so discovery ensures every asset is a candidate for explicit verification rather than an unmonitored gap.