Advanced Security dependency scanning completes, but  AdvancedSecurity/NewHighAndCritical  PR status is never published

Erik Lindstén 0 Reputation points
2026-10-19T08:35:05.36+00:00

We configured a required  AdvancedSecurity/NewHighAndCritical  branch policy in Azure DevOps Services, following Microsoft’s documentation and leaving the advanced policy options at their defaults.

A build validation pipeline runs  AdvancedSecurity-Dependency-Scanning@1 . In a controlled test, the scan:

• Completes successfully, including vulnerability processing.

• Detects newly introduced High-severity dependency vulnerabilities.

• Posts dependency-scanning annotations on the pull request.

However, no  AdvancedSecurity  status appears in the PR statuses API. The required policy remains Waiting, with  latestStatusId: null , several days after the build completed.

Recreating the PR did not resolve the issue. We also added:

  • task: AdvancedSecurity-Publish@1 inputs: WaitForProcessing: true

That task reported no SARIF files in its default input directory.

The documentation appears inconsistent: the PR-status reference instructs dependency-scanning users to enable processing waits on  AdvancedSecurity-Publish , while the Publish-task reference says it is unnecessary with  AdvancedSecurity-Dependency-Scanning@1 .

Questions:

  1. What is the supported configuration for publishing native Advanced Security PR statuses with dependency-only scanning?
  2. Is an additional prerequisite needed beyond repository enablement, build validation, scanning, and the status policy?
  3. Where can we inspect or troubleshoot the native status-publication process?
Azure DevOps
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Salamat Shah 990 Reputation points MVP
    2026-10-29T12:02:54.3633333+00:00

    Dear Erik,

    If AdvancedSecurity/NewHighAndCritical remains Waiting and no PR status is published, the most common causes are:

    • Microsoft Defender for DevOps / Advanced Security processing has not completed even though dependency scanning finished.
    • The repository or project is not fully enabled for Advanced Security features.
    • The policy expects a native Advanced Security status that isn't being generated due to a configuration or service-side issue.
    • AdvancedSecurity-Publish@1 is mainly used for SARIF-based results; dependency scanning usually doesn't require SARIF files.

    Recommendations:

    • Verify Advanced Security is enabled at both the repository and project level.
    • Confirm the scan results appear in the Security - Dependency vulnerabilities view.
    • Check pipeline logs for any Advanced Security processing warnings/errors after the scan task completes.
    • Remove and recreate the branch policy to refresh the status check.
    • If scans complete and findings appear but the PR status is still never published after several hours/days, open a Microsoft Support ticket, as this may be a backend synchronization issue.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.