Azure DevOps — Complete Setup Guide

CodeScan connects to your Azure DevOps repository using the REST API and a Personal Access Token (PAT). It fetches your source files, runs the full AI security pipeline on them, applies fixes, and opens a Pull Request — all without installing any extension, agent, or marketplace listing. This guide walks through every step from zero to your first fix PR.

Step 1 — Find your organisation, project, and repository names

Every Azure DevOps resource lives under three identifiers. You need all three to connect CodeScan.

Step 2 — Create a Personal Access Token (PAT)

A PAT is a secure alternative to your password. It grants CodeScan exactly the permissions it needs — nothing more.

2a. Open the PAT management page

1. Sign in at dev.azure.com
2. Click your profile avatar in the top-right corner
3. Select Personal access tokens from the dropdown
4. You will land on the User settings → Personal Access Tokens page

2b. Create the token

1. Click + New Token
2. Fill in the form:
   Namee.g. CodeScan Security Scanner

   OrganisationSelect the organisation that owns the repo you want to scan

   Expiration90 days recommended — you can regenerate it later
3. Under Scopes, select Custom defined
4. Expand the Code section and tick:
   ☑

   Code (Read) — Fetch source files from the repository

   ☑

   Code (Write) — Create branches and commit AI-generated fixes

   ☑

   Pull Request (Contribute) — Open the fix Pull Request
5. Click Create
6. Copy the token immediately — Azure DevOps shows it only once. Paste it somewhere safe before closing the dialog.

Step 3 — Use the Azure tab in the CodeScan web scanner

3a. Open the Remote Repo panel

1. Go to codesscan.com/scan and sign in
2. In the left sidebar, click the ⎇ REMOTE REPO tab (next to ⬆ FILES)
3. At the top of the panel you will see three provider chips — click Azure

3b. Fill in the fields

3c. Fetch & Scan

Click ⎇ Fetch & Scan. CodeScan will:

1. Authenticate with Azure DevOps using your PAT
2. Retrieve the recursive file tree for the default branch (up to 60 source files)
3. Fetch each file's content in parallel
4. Run the full 5-step AI security pipeline on every file
5. Run secret scanning in parallel (looks for hardcoded API keys, tokens, passwords)
6. Show results in the CODE FINDINGS, DEPENDENCIES, and SECRETS tabs

The sidebar will confirm the fetch with the repo name, branch, and number of files loaded.

Step 4 — Review and apply fixes

Apply a fix to a single vulnerability

1. In the CODE FINDINGS tab, click any file card to open the Detail view
2. Click a vulnerability to open its full description
3. Click ⚡ Apply AI Fix — the fix is generated and applied to the file in the scanner
4. Use the Show diff toggle to see exactly what changed

Use CodescanBot to apply fixes (conversational)

1. Open CodescanBot (click ◈ CodescanBot in the header or press Ctrl+K)
2. Select a vulnerability from the list
3. Click the ⚡ Apply fix chip or type “fix this”
4. The bot explains the change and applies it — the file updates automatically

Step 5 — Create the Fix Pull Request

Once one or more files have been patched in the scanner, a green button appears in the sidebar:

1. Click ⎇ Create Fix PR
2. A modal opens. Confirm or edit:
   • Branch name — default: codescan/security-fixes-YYYYMMDD
   • PR title — default: [CodeScan] Security fixes — N file(s) patched
3. Click ⎇ Create PR
4. CodeScan creates the branch, commits all patches in a single push, and opens the PR
5. The PR URL appears in the sidebar — click it to review the diff on Azure DevOps before merging

What the PR looks like in Azure DevOps

• Source branch: codescan/security-fixes-20260514
• Target branch: your default branch (e.g. main)
• Description lists every patched file with a review checklist
• The Files tab shows the exact diff — only vulnerable lines changed
• Run your pipelines and tests, then complete/approve the PR normally

Step 6 — Using the CLI instead

The CLI gives you the same scan + fix + PR capability from your terminal, perfect for CI/CD automation.

Install & login

npm install -g codescan-flowlog
codescan login

Set your PAT as an environment variable

export AZURE_DEVOPS_TOKEN=your-pat-here
# Now all azure commands use it automatically

Scan a repo (read-only — nothing written to Azure)

# Basic scan of the default branch
codescan azure scan contoso/backend-services/api-server

# Scan a specific branch
codescan azure scan contoso/backend-services/api-server --branch develop

# Show every finding (not just summary)
codescan azure scan contoso/backend-services/api-server --verbose

# Save full JSON report
codescan azure scan contoso/backend-services/api-server --output report.json

# Scan more than 60 files
codescan azure scan contoso/backend-services/api-server --max-files 100

Scan + fix + open PR (one command)

# Fix high+ severity and open PR
codescan azure fix contoso/backend-services/api-server

# Preview without writing (dry run)
codescan azure fix contoso/backend-services/api-server --dry-run

# Fix only critical findings
codescan azure fix contoso/backend-services/api-server --severity critical

# Custom branch and PR title
codescan azure fix contoso/backend-services/api-server \
  --pr-branch security/q2-patches \
  --pr-title "Security: patch SQL injection and XSS — Sprint 42"

# Scan a non-default branch
codescan azure fix contoso/backend-services/api-server --branch staging

Recommended workflow

# 1. Dry run to preview what would change
codescan azure fix org/project/repo --dry-run

# 2. Review the output, then apply
codescan azure fix org/project/repo

# 3. The PR URL is printed — open it and review the diff
# 4. Run tests in Azure Pipelines, then complete the PR

CLI flag reference — codescan azure

Azure Pipelines — automated security scanning

Add CodeScan to your Azure Pipeline so every PR is scanned automatically. The job fails if critical vulnerabilities are found, blocking the merge.

# azure-pipelines.yml
trigger:
  branches:
    include: [main, develop]

pr:
  branches:
    include: ["*"]

pool:
  vmImage: ubuntu-latest

steps:
  - task: NodeTool@0
    inputs:
      versionSpec: "20.x"

  - script: npm install -g codescan-flowlog
    displayName: Install CodeScan CLI

  - script: |
      codescan scan --dir ./src \
        --gate \
        --sarif-out $(Build.ArtifactStagingDirectory)/results.sarif \
        --save-history \
        --fail-on high
    displayName: Run CodeScan Security Scan
    env:
      CODESCAN_TOKEN: $(CODESCAN_TOKEN)

  - task: PublishBuildArtifacts@1
    condition: always()
    inputs:
      pathToPublish: $(Build.ArtifactStagingDirectory)
      artifactName: codescan-results

Add CODESCAN_TOKEN as a Pipeline variable: Project settings → Pipelines → Library → + Variable group → add CODESCAN_TOKEN and mark it as secret.

Troubleshooting

Quick reference cheatsheet

# ── Setup ─────────────────────────────────────────────────────────
export AZURE_DEVOPS_TOKEN=your-pat

# ── Find your repo identifier ──────────────────────────────────────
# URL: dev.azure.com/{org}/{project}/_git/{repo}
# Use: {org}/{project}/{repo}   e.g. contoso/backend/api-server

# ── Scan ──────────────────────────────────────────────────────────
codescan azure scan org/project/repo              # default branch
codescan azure scan org/project/repo --branch dev  # specific branch
codescan azure scan org/project/repo --verbose     # all findings
codescan azure scan org/project/repo --output r.json

# ── Fix + PR ──────────────────────────────────────────────────────
codescan azure fix  org/project/repo               # fix high+ → PR
codescan azure fix  org/project/repo --dry-run     # preview
codescan azure fix  org/project/repo --severity critical
codescan azure fix  org/project/repo --pr-branch security/q2-fixes

# ── Web UI ────────────────────────────────────────────────────────
# codesscan.com/scan → ⎇ REMOTE REPO → Azure chip
# Enter: org/project/repo + PAT → Fetch & Scan → Create Fix PR