Simplifying Docker Authentication in Azure DevOps with Azure Workload Identity

Credential based authentication methods have several disadvantages such as security risks and secret management overhead. As a solution Azure Managed Identity and Azure Workload Identity can be used as modern and secure, non-credential-based authentication method for workloads running outside or inside Azure.

Workload Identity Federation can now be used with Azure DevOps Docker service connection targeting Azure Container Registry. This blog will explain how to use workload Identity with Azure DevOps Docker service connection.

Scan Code in Azure DevOps Build Pipelines Using Microsoft Security DevOps

Static code analysis is a mechanism to find and fix security vulnerabilities in source code without running the software. This blog explains how to integrate Microsoft Security DevOps to a build pipeline, which installs and configures static code analysis tools against your source code.

Pre-requisites: 

• Azure DevOps build pipeline
• Build agent which has .NET 6 (for MicrosoftSecurityDevOps build task) and NET 3.1 (CredScan analyzer) installed.