Establish organization-wide secure defaults for repository security
Implementation Effort: Medium – Configuring organization and enterprise security settings plus repository onboarding automation across GitHub and Azure DevOps takes several steps and licensing coordination. User Impact: Low – Enabling secure defaults is an administrator configuration; developers are not prompted or affected. Lifecycle Stage: Code
Overview
In GitHub Enterprise Cloud, configure organization or enterprise security settings so new repositories inherit secure defaults for code scanning, secret scanning, and dependency protections where supported. In Azure DevOps, enable GitHub Advanced Security for Azure DevOps at the organization or project level and establish onboarding automation or policy so new repositories get secret scanning, dependency scanning, and CodeQL enabled where supported.
In GitHub Enterprise Cloud, organization owners can enable code scanning with CodeQL through GitHub Code Security, secret scanning and push protection through GitHub Secret Protection, and other security-and-analysis settings for new repositories. Use security configurations, the dependency graph, Dependabot alerts, and security updates where supported so repositories start with a consistent baseline.
In Azure DevOps, enable GitHub Advanced Security for Azure DevOps at the organization or project level where licensed, then configure secret scanning, dependency scanning, and code scanning (CodeQL) per repository as supported. Use project settings and policy to make secure defaults the standard path rather than an opt-in exception.
For broader cross-platform posture visibility, pair platform-native settings with Microsoft Defender for Cloud DevOps.
When organization security settings are left at defaults, newly created repositories inherit no code scanning, secret scanning, or dependency analysis. This creates blind spots where vulnerabilities and credentials accumulate undetected.
Threat actors target the newest, least-governed repositories because they lack security controls. Enabling security features by default ensures every repository produces security signals from its first commit, enabling early detection and response. Producing security signals from the first commit reflects Assume breach, ensuring that even a compromised or overlooked repository is continuously monitored rather than silently trusted.