> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-azure-pipelines.md).
# Azure Pipelines
Integrate Prisma Cloud Code Security with Azure Pipelines to seamlessly embed vulnerability detection into your Azure DevOps CI/CD pipelines. This integration enables continuous scanning and detection of your your infrastructure as code (IaC) and code repositories as a part of your CI/CD workflows. Additionally, it automates shift-left actions and provides reporting and tracking on the Prisma Cloud administrative console.
1. Before you begin, [generate and copy the Prisma Cloud access key](/content-collections/administration/create-access-keys.md) to enable access to Prisma Cloud. The access key includes a Key ID and Secret.
2. Create or open the `.azure-pipelines.yml` file in your repository for editing, or alternatively, navigate to **CI/CD** > **Editor** in your Azure project.
3. In **Azure DevOps**, create a new pipeline or select an existing pipeline and select **Edit**.
An editor for the `azure-pipelines.yml` configuration file is displayed.
4. Add the following steps into your pipeline jobs or stages, based on your current configuration.
```yaml
- task: UsePythonVersion@0
inputs:
versionSpec: '3.8'
displayName: 'Install Python 3.8'
- script: pip install checkov
displayName: 'Install Checkov'
- script: checkov -d --bc-api-key :: --repo-id --branch
displayName: 'Scan with Prisma Cloud'
env:
PRISMA_API_URL:
```
The code snippet above includes the following arguments:
* \: The directory of the repository you wish to scan.
* \::\: A combination of your Prisma Access Key and Prisma Secret Key. As a best practice, store this access the access key and secret in a vault
* \: Your VCS organization name and repository name
* \: The branch to be scanned
* \: The **API URL** for your Prisma Cloud stack. Refer to the [available list of URLs](/content-collections/get-started/console-prerequisites.md) for more information.
Use `--soft-fail` to scan the build for errors without failing the job or stage.
For additional scan settings, refer to the [CLI Command Reference guide](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html).
## Verify Integration
To verify the integration with Prisma Cloud, in **Application Security**, select **Home** > **Settings** > **CICD Runs** tab. Your integrated repositories will be displayed. You may have to wait for up to three minutes before the status of the integration is updated.
Although the Prisma Cloud UI does not natively support an Azure Pipelines integration, your repository will still be visible in the UI as a CLI Repository.
## USAGE
After completing the integration, Prisma Cloud will automatically conduct a scan, and the outcomes will be presented in the pipeline logs and on the **Projects** page of the Prisma Cloud console.
## EXAMPLE
The following example describes a full pipeline enabled for the Prisma Cloud Code Security scan that also sends results to the **Azure Pipeline Tests** section.
```yaml
trigger:
- main
pr:
- main
pool:
vmImage: ubuntu-latest
variables:
PRISMA_API_URL: https://api.prismacloud.io
jobs:
- job: Prisma_Cloud_Job
displayName: Prisma Cloud Job
steps:
- task: AzureKeyVault@2
inputs:
azureSubscription: 'pipeline-connection'
keyVaultName: 'pipeline-vault'
secretsFilter: '*'
runAsPreJob: false
- task: UsePythonVersion@0
inputs:
versionSpec: 3.8
displayName: 'Use Python 3.8'
- script: pip install checkov
displayName: Install Checkov
- script: checkov -d . --use-enforcement-rules --bc-api-key $(prisma-access-key)::$(prisma-secret-key) --repo-id prismaiac/bicepgoat --branch main -o cli -o junitxml --output-file-path console,CheckovReport.xml
workingDirectory: $(System.DefaultWorkingDirectory)
displayName: Run Checkov
- task: PublishTestResults@2
inputs:
testResultsFormat: 'JUnit'
testResultsFiles: '**/CheckovReport.xml'
testRunTitle: PrismaCloudTests
displayName: Publish Test Results
condition: always()
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-azure-pipelines.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.