Azure DevOps announces agentic Copilot Autofix for dependencies and code alerts
🛡️ Microsoft announced Agentic Autofix for GitHub Advanced Security for Azure DevOps, expanding suggested remediation beyond a limited set of CodeQL rules to supported third-party code-scanning findings and dependency vulnerabilities.
The agent uses repository context and supported custom instructions or skills to prepare fixes as pull requests; engineers remain responsible for reviewing and testing proposed changes.
Microsoft says rollout takes two to three weeks, with a public preview planned for November 2026. The initial capability is available to organizations in the limited public preview.
Generating fixes consumes AI credits; simply enabling Autofix does not trigger charges for generated fixes.
Partner briefing
- What it is
Agentic Copilot Autofix for code and dependency vulnerabilities in GitHub Advanced Security for Azure DevOps.
- What’s changing
Broadens suggested fixes to supported dependency vulnerabilities and third-party scanning alerts, using repository context and custom instructions. Limited preview availability with broader public preview planned for November.
- Why it matters
Security and engineering teams can request reviewed, context-aware remediation pull requests.
- Who it affects
Azure DevOps engineering teams, security specialists and application modernization partners.