Microsoft Brings Agentic Autofix to Azure DevOps for Code and Dependencies

AIDeveloper44 Team

Advancing Automated Security Remediation

Microsoft has announced an update to Copilot Autofix within GitHub Advanced Security for Azure DevOps. The transition to an "agentic" foundation represents a significant change in how the platform handles security remediation. By leveraging the Copilot coding agent, the system can now navigate repository-specific context, such as established coding standards, validation helpers, and internal package-update procedures, to generate more accurate and context-aware fixes.

Previously, Copilot Autofix was primarily restricted to generating resolutions for a defined set of CodeQL rules. With the new update, this capability extends to a broader range of code scanning alerts, including those generated by third-party security tools. This shift allows teams to apply automated remediation across a wider variety of security findings within their existing Azure DevOps workflows.

Integrating Repository Context

A primary challenge in automated remediation is ensuring that generated code changes align with a team's internal technical requirements. Agentic Autofix addresses this by allowing developers to provide additional guidance through custom instructions and skills. These are stored in supported locations such as .github or .agents directories within the repository.

For instance, developers can configure the agent to prioritize specific input-validation functions that are approved for use across the organization. Similarly, specialized "dependency-update" skills can be defined to dictate the exact steps for package upgrades and compatibility verification. By utilizing these instructions, the agent can reduce the amount of post-generation refinement required by engineers, as the proposed fixes are designed to integrate more seamlessly into the existing codebase.

Dependency Vulnerability Management

In addition to code-level security, the update introduces a dedicated workflow for handling dependency vulnerabilities. When dependency scanning identifies a vulnerable package, users can select a "Generate fix" option within the Azure DevOps interface. The agentic system then creates a pull request that includes both the suggested code change and an explanation of the fix, allowing teams to review the remediation through their standard code review process.

To assist with the prioritization of these alerts, Microsoft has introduced two key data points: the Exploit Prediction Scoring System (EPSS) and development dependency detection. The EPSS provides an estimate of the relative likelihood that a vulnerability will be exploited in the wild based on available data. While it does not represent the probability of an attack against a specific application, it serves as a metric for ranking vulnerabilities.

Simultaneously, the platform now differentiates between development-only dependencies and runtime dependencies. By using the new Development badge and Scope filters, teams can isolate runtime vulnerabilities, which often pose a greater risk to production environments. This allows security teams to focus their efforts on the most critical alerts first.

Availability and Implementation

The rollout of Agentic Autofix is scheduled to occur over a two-to-three-week period. Once enabled at the organization, project, or repository level, users can trigger fixes for individual alerts. The system is expected to reach public preview status in November. Microsoft emphasizes that while the tool generates automated suggestions, all changes should be thoroughly tested and reviewed before they are merged into the main codebase.

Generating these fixes will consume AI credits, and the company notes that not every alert will produce a viable automated solution. As with any AI-driven development tool, human oversight remains a mandatory component of the security lifecycle, ensuring that proposed changes are both secure and functional within the specific constraints of the project.

Enjoyed this?

Get more posts like this delivered to your inbox.

Subscribe