{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/", "slug": "dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate", "url": "https://update.dsesecurity.com/updates/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/" }, "title": "Separate scheduled default-branch scans from a pull-request release gate", "summary": "Does Defender for Cloud agentless code scanning evaluate every proposed change before a build proceeds?", "format": { "slug": "briefing", "name": "Briefing" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:25:05+00:00", "modified_at": "2026-09-10T02:04:57+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 244, "potentially_affected": "Supported Azure DevOps and GitHub connectors using Defender for Cloud agentless code scanning, currently in preview.", "dse_recommendation": "Document scheduled repository coverage separately from the checks that actually decide whether a proposed change may merge or release.", "primary_source": { "name": "Configure agentless code scanning (Preview) - Microsoft Defender for Cloud | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-code-scanning", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Defender for Cloud’s agentless code scanning is in preview. The documented process discovers repositories initially and every eight hours, but retrieves code from each repository’s default branch initially and daily. Its comparison with in-pipeline scanning explicitly says agentless scanning cannot break builds. Finding a repository through the connector is therefore different from evaluating each proposed change during its build. Microsoft Learn.

\n

Applicability

\n

Review supported Azure DevOps or GitHub connectors, current regional availability, enabled scanners, and the actual repository scope. Identify the default branch and the branch or revision involved in the release decision. This brief does not claim that every language, artifact, or repository is scanned by every tool.

\n

DSE recommendation

\n

Document scheduled repository coverage separately from the checks that actually decide whether a proposed change may merge or release. Have security and development owners name the evidence required for each decision. Preserve an explicit gap when a proposed revision lacks the intended pre-release check rather than treating a connector recommendation as an automatic build gate.

\n

Verification

\n

Compare the repository’s observed discovery and scan records with its default branch and recent changes. Then inspect the pipeline or merge controls independently to establish which checks can prevent progression. Use a harmless test change in an approved repository to validate the intended workflow. Record the evaluated revision and decision point without claiming that a later scheduled result represents an earlier pull-request assessment.

\n

Official references

\n

Microsoft Learn: Configure agentless code scanning (Preview). Source reviewed September 9, 2026.

", "content_text": "Source facts\nDefender for Cloud’s agentless code scanning is in preview. The documented process discovers repositories initially and every eight hours, but retrieves code from each repository’s default branch initially and daily. Its comparison with in-pipeline scanning explicitly says agentless scanning cannot break builds. Finding a repository through the connector is therefore different from evaluating each proposed change during its build. Microsoft Learn.\nApplicability\nReview supported Azure DevOps or GitHub connectors, current regional availability, enabled scanners, and the actual repository scope. Identify the default branch and the branch or revision involved in the release decision. This brief does not claim that every language, artifact, or repository is scanned by every tool.\nDSE recommendation\nDocument scheduled repository coverage separately from the checks that actually decide whether a proposed change may merge or release. Have security and development owners name the evidence required for each decision. Preserve an explicit gap when a proposed revision lacks the intended pre-release check rather than treating a connector recommendation as an automatic build gate.\nVerification\nCompare the repository’s observed discovery and scan records with its default branch and recent changes. Then inspect the pipeline or merge controls independently to establish which checks can prevent progression. Use a harmless test change in an approved repository to validate the intended workflow. Record the evaluated revision and decision point without claiming that a later scheduled result represents an earlier pull-request assessment.\nOfficial references\nMicrosoft Learn: Configure agentless code scanning (Preview). Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nDefender for Cloud’s agentless code scanning is in preview. The documented process discovers repositories initially and every eight hours, but retrieves code from each repository’s default branch initially and daily. Its comparison with in-pipeline scanning explicitly says agentless scanning cannot break builds. Finding a repository through the connector is therefore different from evaluating each proposed change during its build. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-code-scanning).\n\n## Applicability\n\nReview supported Azure DevOps or GitHub connectors, current regional availability, enabled scanners, and the actual repository scope. Identify the default branch and the branch or revision involved in the release decision. This brief does not claim that every language, artifact, or repository is scanned by every tool.\n\n## DSE recommendation\n\nDocument scheduled repository coverage separately from the checks that actually decide whether a proposed change may merge or release. Have security and development owners name the evidence required for each decision. Preserve an explicit gap when a proposed revision lacks the intended pre-release check rather than treating a connector recommendation as an automatic build gate.\n\n## Verification\n\nCompare the repository’s observed discovery and scan records with its default branch and recent changes. Then inspect the pipeline or merge controls independently to establish which checks can prevent progression. Use a harmless test change in an approved repository to validate the intended workflow. Record the evaluated revision and decision point without claiming that a later scheduled result represents an earlier pull-request assessment.\n\n## Official references\n\n[Microsoft Learn: Configure agentless code scanning (Preview)](https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-code-scanning). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/", "url": "https://update.dsesecurity.com/updates/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate scheduled default-branch scans from a pull-request release gate", "item": "https://update.dsesecurity.com/updates/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/", "url": "https://update.dsesecurity.com/updates/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/", "headline": "Separate scheduled default-branch scans from a pull-request release gate", "description": "Does Defender for Cloud agentless code scanning evaluate every proposed change before a build proceeds?", "abstract": "Does Defender for Cloud agentless code scanning evaluate every proposed change before a build proceeds?", "articleBody": "Source facts\nDefender for Cloud’s agentless code scanning is in preview. The documented process discovers repositories initially and every eight hours, but retrieves code from each repository’s default branch initially and daily. Its comparison with in-pipeline scanning explicitly says agentless scanning cannot break builds. Finding a repository through the connector is therefore different from evaluating each proposed change during its build. Microsoft Learn.\nApplicability\nReview supported Azure DevOps or GitHub connectors, current regional availability, enabled scanners, and the actual repository scope. Identify the default branch and the branch or revision involved in the release decision. This brief does not claim that every language, artifact, or repository is scanned by every tool.\nDSE recommendation\nDocument scheduled repository coverage separately from the checks that actually decide whether a proposed change may merge or release. Have security and development owners name the evidence required for each decision. Preserve an explicit gap when a proposed revision lacks the intended pre-release check rather than treating a connector recommendation as an automatic build gate.\nVerification\nCompare the repository’s observed discovery and scan records with its default branch and recent changes. Then inspect the pipeline or merge controls independently to establish which checks can prevent progression. Use a harmless test change in an approved repository to validate the intended workflow. Record the evaluated revision and decision point without claiming that a later scheduled result represents an earlier pull-request assessment.\nOfficial references\nMicrosoft Learn: Configure agentless code scanning (Preview). Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:25:05+00:00", "dateModified": "2026-09-10T02:04:57+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-411-separate-scheduled-default-branch-scans-from-a-pull-request-release-gate/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate scheduled default-branch scans from a pull-request release gate" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Briefing", "Information priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 244, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure agentless code scanning (Preview) - Microsoft Defender for Cloud | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-code-scanning" } } ] } }