Mikael Krief

Posted on Aug 20

Azure DevOps: a Roundup of the Latest Features (May–July 2026)

#azuredevops

Azure DevOps keeps shipping on its three-week sprint cadence, and the latest sprints (269, then 273 through 277, released between late 2025 and the end of July 2026) bring a solid batch of concrete updates: ever-deeper GitHub Copilot integration, Git repositories with no size ceiling, better pull request visibility in Boards, and broader support for self-hosted agents. Here's a rundown of the most notable changes, organized by theme.

GitHub Copilot in Azure DevOps: the integration is accelerating

This is the throughline of the past few months: Microsoft is methodically bringing Azure DevOps closer to the GitHub Copilot ecosystem, on three separate fronts.

The Copilot coding agent has landed on Azure Boards. Since December 16, 2025 (now generally available, rolled out gradually in waves), teams can assign an Azure Boards work item directly to GitHub Copilot's coding agent. In practice: you describe the task in the work item's fields, click the Copilot button, and the agent forwards the description and recent comments to the coding agent, which creates a branch, generates a draft pull request linked back to the original work item, and lets you track progress from both the work item and the Kanban board cards. Requirements: the code must be hosted on GitHub, with Azure Boards–GitHub integration and the coding agent enabled on the relevant repositories. Sprint 275 (June 2026) added the ability to choose the AI model the coding agent uses when generating its pull requests, since different models produce different results depending on the project's context.

Copilot now reviews pull requests in Azure Repos. Announced as a limited preview in sprint 275 (June 2026), Copilot Code Reviews for Azure Repos lets you request an AI code review directly on a pull request, without leaving Azure DevOps or migrating to GitHub. Just click "Request": Copilot analyzes the changes and adds comments and suggestions directly on the review, flagging potential bugs, code quality issues, and maintainability concerns. It's limited to Git repositories (no TFVC support), repos under 10 GB, and pull requests with fewer than 100 changed files, with one completed review per merge commit. The initial private preview is now closed; Microsoft expects to open a public preview within a few weeks. Each review consumes AI credits billed at $0.01 per credit against the linked Azure subscription — which is why sprint 276 added project tags to the billing data, enabling per-project tracking of Copilot Code Review costs through Azure Cost Management.

Copilot also fixes security vulnerabilities. Alongside Copilot Autofix for GitHub Advanced Security (see below), sprint 275 introduced, in limited preview, GitHub Copilot Autofix for CodeQL code scanning: the AI analyzes code scanning alerts and proposes targeted fixes as pull requests, which developers simply review and merge.

Taken together, the pattern is consistent across all three use cases (Boards, Repos, security): let Copilot handle a first pass — development, review, or remediation — while keeping a human in the approval loop, with consumption-based billing now traceable per project.

Application security: CodeQL reaches general availability

The most structural change of the recent sprints is in GitHub Advanced Security for Azure DevOps (GHAzDO). CodeQL default setup is now generally available (GA): there's no longer any need to author or maintain a dedicated YAML pipeline to enable code scanning, which significantly simplifies rolling out security scanning at scale. Default setup now also supports C/C++, and automatically queues an initial scan as soon as it's enabled, rather than waiting for the scheduled weekly run.

Around CodeQL, several improvements also touch Copilot Autofix (the GHAzDO alert auto-remediation tool, distinct from the Copilot Autofix for CodeQL described above): it can now be enabled at the organization, project, or repository level (previously repository-only), it no longer creates empty branches or pull requests when no fix is generated, Autofix pull requests now appear automatically in the alert detail view without a page refresh, and they carry a "Copilot Autofix" tag instead of a title suffix for easier identification. A clear failure state and a retry option were also added for failed runs. Another security improvement from sprint 275: Advanced Security status checks (AdvancedSecurity/NewHighAndCritical and AdvancedSecurity/AllHighAndCritical) reached general availability, letting teams block pull request completion when a high- or critical-severity alert is detected.

Azure Repos: goodbye to the 100-million-object Git limit

For organizations running large monorepos, the most eagerly awaited change is probably the removal of the 100-million-object limit per Git repository. Repositories can now grow without an artificial ceiling, lifting a real constraint for teams working on large codebases.

On the pull request side, several tweaks improve reviewers' day-to-day: an "External" badge now distinguishes third-party status checks from native Azure DevOps branch policies, the pull request list shows the count of unresolved comment threads (e.g., "1 / 3"), and a direct pull-request-creation link now appears in git push output when publishing a new branch — no more need to jump into the web UI just to start a PR.

Azure Boards: pull request visibility right on the cards

Azure Boards gains a long-requested feature: pull request annotations on cards, enabled by default, let you see linked development activity for a work item at a glance without leaving the board.

Sprint board and sprint backlog filtering has also been extended: you can now filter on additional fields, including custom fields — a capability previously limited to the product backlog and general boards — making it easier to focus on the right scope during sprint planning. Finally, copying work items is more flexible: you can now choose to copy only parent links, only child links, or both, instead of duplicating everything by default.

Azure Pipelines: Windows ARM64 agents, service connection security, and easier navigation

On the Pipelines side, the Windows ARM64 agent in public preview now lets teams run native self-hosted agents on Windows 11 ARM. Service connection security is strengthened with automatic disablement of connections unused for 100 days (a secure-by-default principle), logged in the audit log, with the option to re-enable when needed. In the same vein, the legacy Azure DevOps issuer for workload identity federation service connections is now deprecated, with new connections defaulting to the Microsoft Entra issuer and a retirement date set for July 1, 2027.

For complex deployment pipelines, a stage index panel was added alongside the stages map view, letting you jump straight to a given stage instead of endlessly scrolling through pipelines with dozens or hundreds of stages. Another practical addition: the InvokeRestAPI@1 task now natively supports Azure DevOps service connections, removing the need to configure a generic service connection just to call the Azure DevOps REST API from a pipeline.

Azure Test Plans: step-level actual results reach GA

The Actual Result feature, which lets testers record the actual outcome of each step during a manual test run (text and attachments), has reached general availability. It can be configured as an optional or required field at the test plan level, improves traceability and audit-readiness, and results can be reviewed both in the Test Run Hub and through the REST API.

Wiki and AI: small additions that matter

Azure DevOps wiki Markdown editors now accept standard Mermaid syntax using regular fenced code blocks

mermaid

, in addition to the proprietary ::: mermaid syntax — a welcome alignment with GitHub and other Markdown tools that avoids any conversion when reusing content authored elsewhere.

On the AI front, the Azure DevOps remote MCP server has gained Enterprise Live Migration (ELM) tools, currently in private preview: they let agents orchestrate the migration of Azure DevOps repositories to GitHub Enterprise Cloud with data residency, minimizing disruption for development teams.

The bottom line

These recent sprints paint a clear picture: Microsoft is actively bringing Azure DevOps and GitHub Copilot closer together — a coding agent on Boards, AI code review on Repos, Autofix on security alerts — while also strengthening AI-driven application security (CodeQL GA, multi-level Autofix) and removing scale limits for large repositories. For teams that want to experiment with generative AI in their development cycle without leaving Azure DevOps, or that manage large codebases, these updates are well worth a look.

To keep up with future releases as they ship, the official release notes are published every three weeks on Microsoft Learn.

Sources: official Microsoft Learn release notes and the Azure DevOps blog (sprints 269, 273–277, December 2025–July 2026).

DEV Community