Add Azure Repos to Prisma Cloud Application Security

Verify prerequisites.
To integrate Azure Repos with Prisma Cloud Application Security, ensure access to the Azure DevOps console for authorization and third-party application access via OAuth.
Authorization access.

Access to the Azure DevOps console allows you to grant Prisma Cloud authorization access during integration, enabling it to access organizations and repositories associated with your user token.

Third-party application access via OAuth.

For configuring integration, either for a single organization or multiple organizations using a single user token, you need to enable third-party application access via OAuth in the Azure DevOps console.



The third-party application access via OAuth provides Prisma Cloud access to all organizations associated with your user token.

Do not limit authorization scope

To ensure that Prisma Cloud has access to repositories, ensure the

Limit job authorization scope to current project for non-release pipelines

is set to

OFF

. You can configure this setting on

Project Settings > Settings > General

.


Access Azure Repos on Prisma Cloud Application Security.
Select

Settings > Code & Build Providers > Add

.

Select

Azure Repos

from

Code Repositories

.


Configure an Azure Repos account with Prisma Cloud console.
Select
Authorize
to configure an Azure Repos account for a Single Organization.

Optionally, you can select
Multiple Organization
and then select
Authorize
to set up an Azure Repos account that covers Multiple Organizations.
If you have an existing Azure Repos integration, you can continue with a new organization configuration or choose
Skip
to select repositories for a security scan.
To skip an authorization, you must already have an existing integration.
Access the Azure DevOps console and then select
Accept
to authorize the Prisma Cloud console to access your organization account and repositories.
For an existing Azure Repos integration, you can also opt to
Reselect repositories
to modify the existing configuration or
Revoke OAuth User Token
to edit the user token and associated repositories from the Prisma Cloud console. These options are available for both single organization and multiple organization configurations.

Successful authorization on the Azure DevOps console will redirect you to the Prisma Cloud console.
Enable the CI/CD Security Module (
optional
) to provide protection of the CI/CD systems in your Azure Repos environment.

Provide your
User Name
.
To retrieve your user name, access your Azure organization and then select
User settings > Profile
.
In Azure, generate a Personal Access Token (PAT) and make a copy for safekeeping.
When creating the new token use these values:
Set an
Expiration
date through
Organization > all accessible organizations
.
Scope the authorization access for the token.
Agent Pools (Read)
Analytics (Read)
Auditing (Read Audit Log)
Member Entitlement Management (Read)
Pull Request Threads (Read & write)
Service Connections (Read)
Tokens (Read & manage)
Variable Groups (Read)
In Prisma Cloud console, add the generated PAT under
App Password
and then select
Next
.
Select repositories for scanning.
Select a configured
OAuth user token
to view the associated repositories for a security scan.
A user token is always enabled by default. You can also configure additional user tokens by selecting a specific one. Do not use personal access token generated for CI/CD security integration.
Use the configured tokens displayed on
Configure Account
.
Define the repositories to be scanned from the available options:
Permit all existing repositories
: Enables Prisma Cloud to scan all existing repositories that are associated with the selected PAT
Permit all existing and future repositories
: Enables Prisma Cloud to scan all existing repositories and any new repositories that are subsequently associated with the PAT
Choose from repository list
: This option enables you to select specific repositories for scan
A single repository may be shared across one or more user tokens. In this case, any change made to a shared repository scan applies to all associated user tokens.
Select
Next
to confirm the repository selection and save the changes.
Select
Done
in the
New integration successfully configured
screen.
Verify that the Azure Repos integration with Prisma Cloud is successful.
Select
Settings
>
Code & Build Providers
.
Verify that the
Azure Repos
integration is displayed from the
VCS User Token
column.
You may have to wait for up to three minutes before the status of the integration is updated and displays.

On
Code & Build Providers
, you can also manage the integration by reselection of repositories and deletion of the repository and the integration.
Reselect repositories
: Enables you to access the list of repositories for a scan.
Delete repository
: Enables you to delete repositories for a scan from the account.
Manage VCS user tokens
: Enables you to integrate one or more Azure Repos accounts.
You cannot delete the integration from
Repositories
for an account integration that supports multiple user tokens.
After a application security scan, access
Application Security
>
Projects
to view the latest integrated Azure Repos repositories scan results to Suppress or Fix the policy misconfigurations.