Microsoft Adds AI-Powered Code Fixes to Azure DevOps Security Scanner

Microsoft has expanded its AI-assisted security tooling to Azure DevOps, rolling out a limited preview of Copilot Autofix for GitHub Advanced Security. Rather than simply flagging security issues for developers to fix manually, the feature now generates candidate code changes and proposes them as pull requests for review.

How It Works#

When CodeQL detects a vulnerability in Azure Repos, developers can request an AI-generated fix directly from the Advanced Security dashboard. Copilot analyzes both the specific vulnerability and its broader context in the codebase, then produces a proposed solution—sometimes spanning multiple files to address the root cause rather than just the symptom. The generated fix enters the team's standard pull request workflow, where reviewers and automated tests validate the change before merge.

Closing the Detection-to-Remediation Gap#

For years, static security scanners have excelled at identifying flaws but left developers with the burden of understanding alerts and implementing solutions—a bottleneck Microsoft calls the "last mile" of secure delivery. By pairing CodeQL's semantic analysis engine with GitHub Copilot's code generation, the new tool collapses the time between discovery and proposed remediation. However, Microsoft stresses that humans remain in control: all fixes require review and validation, as AI-generated code can contain incomplete logic, unintended side effects, or test failures.

Part of Broader Feature Convergence#

This rollout continues Microsoft's effort to bring GitHub Advanced Security capabilities to Azure DevOps users who prefer not to migrate to GitHub repositories. The platform already offers secret scanning, dependency scanning, and CodeQL-based scanning; Copilot Autofix rounds out the portfolio by automating remediation suggestions. The move reflects a wider industry trend of embedding AI into security workflows—GitLab, Snyk, Sonar, and Checkmarx are pursuing similar strategies to accelerate the fix-and-validate cycle.

The AI-as-Assistant Model#

Rather than granting autonomous agents the power to merge fixes independently, Microsoft positions Copilot Autofix as an accelerator for routine remediation tasks while preserving existing governance gates. This hybrid approach acknowledges that recent research shows AI-generated solutions still require careful scrutiny; many proposed fixes fail during testing or are rejected for incomplete implementations. By keeping human oversight central, teams gain speed without sacrificing quality assurance.