Overview

Scrut integrates with Azure DevOps to streamline both project management and code review evidence collection. The integration allows users to create and manage work items such as tasks, issues, bugs, and epics, directly from Scrut modules like Policies, Tests, Evidence, and Risk Management. It also connects Azure DevOps repositories with Scrut to automatically collect pull request review evidence, including checks for application changes and ensuring authors are not reviewers of their own pull requests. By syncing these insights into Scrut’s GRC platform, organizations can simplify compliance workflows and maintain audit-ready proof of development and review practices.

Why Connect

Capture PR reviews and pipeline checks as evidence of secure development Prove separation of duties in code changes with immutable records Link releases to control testing for traceable change management.

Supported Automated Tests

Scrut provides pre-built automated tests for Azure DevOps (Version Control) VCS. Here are a few examples of Scrut’s Azure DevOps (Version Control) VCS tests:

• Access reviews completed for all in-scope applications
• Azure DevOps (Version Control) VCS accounts associated with users
• Azure DevOps (Version Control) VCS accounts deprovisioned when employees leave

Supported Automated Evidence

Scrut automates the collection of some evidences for Azure DevOps (Version Control) VCS. Here are a few examples of Scrut’s Azure DevOps (Version Control) VCS-driven evidences that can be collected:

• Code Repository Branch Protection Settings
• Code Repository Server for Software Code Maintenance
• Code Review Results and Action Items
• Custom Code Review Prior Release
• Offboarding - Logical Access & Physical Access Revocation
• Reports of User Access Reviews
• User Access Approval list to Application, Infrastructure and Service