Explanation:

Microsoft Defender for DevOps integrates security analysis directly into CI/CD pipelines such as Azure Pipelines , GitHub Actions , and others. To enable secret scanning (and other code security checks) during the execution of a pipeline in Azure DevOps , the correct integration is through the Microsoft Security DevOps (MSDO) extension - not the older Microsoft Security Code Analysis (MSCA) extension.
Step 1: Install the Microsoft Security DevOps extension Microsoft documentation (Defender for Cloud # Defender for DevOps integration guide) clearly states that:
"To enable scanning and policy enforcement for Azure DevOps pipelines, install the Microsoft Security DevOps extension from the Azure DevOps Marketplace. This extension integrates with Microsoft Defender for Cloud to perform security scans, including secret detection, infrastructure-as-code analysis, and dependency vulnerability checks." The older Microsoft Security Code Analysis (MSCA) extension has been superseded by Microsoft Security DevOps , which provides broader coverage and native Defender for Cloud integration.
Step 2: Add the MSDO scanner steps to the YAML pipeline After installing the extension, you must modify the pipeline definition (YAML) to add MSDO scanning steps .
The syntax typically looks like this:
steps:
- task: MicrosoftSecurityDevOps@1
displayName: ' Run Microsoft Security DevOps '
This step runs all configured scans (including secret scanning) automatically each time the pipeline runs. You add it under the steps section because it represents a specific task in the pipeline workflow.
# Final Answers:
* Install: The Microsoft Security DevOps extension
* Add: Steps