Introduction

Introduction

StepSecurity supports Azure DevOps in two areas: runtime security for pipeline runs, and governance over the identities and tokens that hold access to your Azure DevOps organization.

Capabilities

Area	What it does	Where to configure it
Harden-Runner	Network and runtime security monitoring for Azure Pipelines jobs, including outbound traffic monitoring, file integrity checks, and detections for anomalous behavior during a run	Add the HardenRunner@1 task to your pipeline YAML
PAT Governance	Continuous evaluation of Personal Access Tokens in your Azure DevOps organization against four security controls, with per-token remediation	Settings > Control Evaluation
Identity inventory	Visibility into Personal Access Tokens, service connections, and Entra service principals with access to your organization	Identities & PATs

Harden-Runner currently supports Microsoft-hosted agents.

Getting started

1. Connect your Azure DevOps organization to StepSecurity from the Admin Console. This installs the StepSecurity app in your Azure tenant.
2. Add the Harden-Runner task as the first task in each pipeline job to start collecting runtime telemetry. See Harden-Runner.
3. Enable the Personal Access Token controls you want under Settings > Control Evaluation, and set their thresholds.
4. Configure notification channels and events under Settings > Notifications so violations reach your team.

Documentation

• Overview: the All Controls dashboard and the PAT Governance controls
• Harden-Runner: runtime security for Azure Pipelines
• Identities & PATs: token, service connection, and service principal inventory
• Settings: notifications, control evaluation, and API access
• Admin Console: connecting and managing Azure DevOps organizations