Configure IaC scanning PR annotations for developer feedback
Implementation Effort: Low – Turning on pull request annotations for an existing IaC scanning workflow is a focused configuration change with little coordination. User Impact: Medium – Developers opening pull requests with infrastructure changes will start seeing inline scan findings they must resolve, so that subset of users is affected. Lifecycle Stage: Build
Overview
Configure pull request annotations for infrastructure-as-code scanning so developers see and remediate findings directly in the review workflow.
IaC scanning tools can detect misconfigurations in Bicep, Terraform, ARM, and CloudFormation templates, but the value of those findings depends on whether developers see them and act on them. When scan results are visible only in a centralized dashboard or buried in pipeline logs, findings accumulate and security teams become a bottleneck chasing developers for fixes.
Surface findings where developers already work. When a pull request validation workflow runs Microsoft Security DevOps, it produces SARIF findings that can be injected into the review flow.
In GitHub, upload SARIF results to GitHub code scanning using the github/codeql-action/upload-sarif action in your workflow so findings appear in the Security tab and as pull request check annotations. For private or internal repositories, these code scanning capabilities require GitHub Advanced Security.
Prereqs: DevOps security is enabled in Microsoft Defender for Cloud for the relevant scope, and required plans (for example Defender CSPM, per current documentation) are enabled; then onboard the GitHub or Azure DevOps organization or project through the DevOps connector. After the Defender-side prerequisites are in place, configure the platform-side integration. In GitHub, this requires a connected repository, the Microsoft Security DevOps GitHub Action running on pull_request, and GitHub Advanced Security. In Azure DevOps, use the Microsoft Security DevOps extension together with a connected Azure DevOps environment in Microsoft Defender for Cloud, and enforce branch build validation before turning on pull request annotations.
Microsoft Defender for Cloud pull request annotations are mainly intended for supported infrastructure-as-code findings that map to changed lines in the pull request. Validate connector prerequisites, repository support, and current support for other finding types before promising identical behavior across GitHub and Azure DevOps. Surfacing findings for remediation before code merges supports Verify explicitly, since each change is validated against security policy at review time rather than trusted implicitly.