Implement IaC scanning in CI pipelines
Implementation Effort: Medium – Enabling Defender for Cloud, connecting the DevOps connector, and adding Microsoft Security DevOps scanning with SARIF upload spans security and pipeline teams.
User Impact: Low – IaC scanning runs in the build and reports findings to reviewers; end users are not affected.
Lifecycle Stage: Build
Overview
Scan Infrastructure as Code templates in CI pipelines so misconfigurations are detected before deployment.
This requires Microsoft Defender for Cloud enabled in the relevant subscriptions, GitHub or Azure DevOps connected through a DevOps security connector when using Defender for Cloud DevOps, and verification of the current plan requirements for each feature.
Microsoft Defender CSPM is required for advanced Defender for Cloud DevOps posture capabilities such as code-to-cloud mapping. Basic CI scanning with Microsoft Security DevOps — the GitHub Action and Azure DevOps extension — runs open-source analyzers and does not require a Defender for Cloud plan. Confirm your required plan tier based on the specific Defender for Cloud features your organization intends to use beyond basic CI scanning. For GitHub repositories, GitHub code scanning and related pull request feedback use GitHub Code Security where required.
Infrastructure-as-code templates for Bicep, ARM, and Terraform define the cloud resources that production workloads depend on. When those templates contain misconfigurations — such as storage accounts with public access, databases without encryption at rest, or network security groups with overly broad inbound rules — the resulting deployed infrastructure inherits those weaknesses.
Scanning IaC files during the CI pipeline catches these issues at the point where they are cheapest and easiest to fix: in a pull request, before the code merges.
Microsoft Security DevOps provides a GitHub Action and an Azure DevOps extension that run open-source analyzers such as Checkov, Terrascan, and Trivy against IaC templates as part of a normal build.
Findings are reported in SARIF format, but SARIF upload and pull request feedback differ by platform.
GitHub Repositories
Upload SARIF results to GitHub code scanning to surface alerts and pull request feedback. Public repositories can use GitHub code scanning without GitHub Code Security, while private and internal repositories require GitHub Code Security.
Azure DevOps
Use AdvancedSecurity-Publish@1 to publish SARIF into GitHub Advanced Security for Azure DevOps, which creates code scanning alerts.
Microsoft Defender for Cloud
Configure pull request annotations separately by following the documented onboarding and workflow prerequisites for Microsoft Security DevOps findings. In GitHub, onboard the repository to Microsoft Defender for Cloud, run the Microsoft Security DevOps GitHub Action on pull requests, and enable GitHub Code Security where required. In Azure DevOps, use the Microsoft Security DevOps extension, onboard the repository through the Azure DevOps connector, and configure the documented branch validation prerequisites.
Microsoft Defender for Cloud can also map Infrastructure as Code templates to cloud resources for supported scenarios when Microsoft Defender CSPM is enabled and the documented onboarding, tagging, and scanning prerequisites are met. Treat that mapping as a specific Defender for Cloud capability rather than as a generic outcome of any SARIF upload or any IaC scan.
Organizations that skip this step usually discover misconfigurations only after deployment through runtime scanning, incident investigation, or compliance audits, when remediation is slower, riskier, and more expensive. Scanning IaC before deployment applies Verify explicitly by validating infrastructure definitions against security baselines before they are trusted, and it supports Assume breach by assuming templates may carry misconfigurations that must be caught rather than deployed unchecked.