Azure DevOps comes up in two ways in the Safeguard docs. Azure Repos is named as a supported source of code, and Azure DevOps is named as a supported CI/CD pipeline. The docs are thinner here than for Bitbucket, so this post is short and sticks to what is written.
What it is
The ESSCM overview lists source code from GitHub, GitLab, Bitbucket and Azure Repos, and CI/CD pipelines from GitHub Actions, GitLab CI, Jenkins and Azure DevOps. It does not link a dedicated Azure Repos page.
How to use it
For repositories, use Integrations in the console and look for the SCM options. The Integrations page lists GitHub, Bitbucket, GitLab and a generic Git URL as cards. I could not confirm a separate Azure Repos card from the docs, so check your own console. If you do not see one, the generic Git URL option is the documented route for other Git hosts.
For pipelines, the CI/CD docs give a script step with the display name Safeguard detect. It runs the install command and then:
curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_VERSION=<version> bash
safeguard detect --format sarif --output $(Build.ArtifactStagingDirectory)/safeguard.sarif
Pin the version. The docs recommend it so releases do not change builds unexpectedly. safeguard detect exits 0 when the scan ran, whatever it found, and returns non-zero only if the command itself fails, for example with an invalid --detect value.
What the pipeline does not do
There is no published Safeguard pipeline plugin for Azure DevOps. The CLI has no severity threshold flag, so a failing build comes from platform policy gates and not from the CLI exit code.
Quick check
Is there an official Azure DevOps pipeline plugin for the CLI?
No. The docs say there is no published GitHub Action, container image or pipeline plugin for the CLI yet. Use a script step.
