Advanced Security dependency scanning completes, but AdvancedSecurity/NewHighAndCritical PR status is never published

Question

Advanced Security dependency scanning completes, but AdvancedSecurity/NewHighAndCritical PR status is never published

Erik Lindstén 0

We configured a required AdvancedSecurity/NewHighAndCritical branch policy in Azure DevOps Services, following Microsoft’s documentation and leaving the advanced policy options at their defaults.

A build validation pipeline runs AdvancedSecurity-Dependency-Scanning@1 . In a controlled test, the scan:

• Completes successfully, including vulnerability processing.

• Detects newly introduced High-severity dependency vulnerabilities.

• Posts dependency-scanning annotations on the pull request.

However, no AdvancedSecurity status appears in the PR statuses API. The required policy remains Waiting, with latestStatusId: null , several days after the build completed.

Recreating the PR did not resolve the issue. We also added:

task: AdvancedSecurity-Publish@1 inputs: WaitForProcessing: true

That task reported no SARIF files in its default input directory.

The documentation appears inconsistent: the PR-status reference instructs dependency-scanning users to enable processing waits on AdvancedSecurity-Publish , while the Publish-task reference says it is unnecessary with AdvancedSecurity-Dependency-Scanning@1 .

Questions:

What is the supported configuration for publishing native Advanced Security PR statuses with dependency-only scanning?
Is an additional prerequisite needed beyond repository enablement, build validation, scanning, and the status policy?
Where can we inspect or troubleshoot the native status-publication process?

0 comments

1 answer

Your answer

Answer 1

Salamat Shah 990 MVP

Dear Erik,

If AdvancedSecurity/NewHighAndCritical remains Waiting and no PR status is published, the most common causes are:

Microsoft Defender for DevOps / Advanced Security processing has not completed even though dependency scanning finished.
The repository or project is not fully enabled for Advanced Security features.
The policy expects a native Advanced Security status that isn't being generated due to a configuration or service-side issue.
AdvancedSecurity-Publish@1 is mainly used for SARIF-based results; dependency scanning usually doesn't require SARIF files.

Recommendations:

Verify Advanced Security is enabled at both the repository and project level.
Confirm the scan results appear in the Security - Dependency vulnerabilities view.
Check pipeline logs for any Advanced Security processing warnings/errors after the scan task completes.
Remove and recreate the branch policy to refresh the status check.
If scans complete and findings appear but the PR status is still never published after several hours/days, open a Microsoft Support ticket, as this may be a backend synchronization issue.

Erik Lindstén 0 Reputation points

2026-11-02T07:23:36.8966667+00:00

Both Secret Protection and Code Security are enabled for the repository, and Dependency vulnerabilities is populated with findings. However, AdvancedSecurity/NewHighAndCritical remains Waiting and no corresponding PR status is published. What should we check next to determine why the native status isn’t being generated?
Erik Lindstén 0 Reputation points

2026-11-02T08:26:27.43+00:00

We have also checked the native Advanced Security dependency-scanning logs. They confirm that results were submitted successfully, vulnerability processing reached “Completed”, and the task finished successfully with exit code 0.

However, AdvancedSecurity/NewHighAndCritical still shows Waiting on the published PR. The status-check policy is enabled on the target branch, set to Apply by default, and has no path filter.

We have not yet removed and recreated the policy. Before doing so, can you confirm whether AdvancedSecurity/NewHighAndCritical is a supported native status that Advanced Security publishes automatically, or whether we need to configure a separate status publisher?