Defender for DevOps connects to your source code management system, for example, Azure DevOps, GitHub, to provide a central console for your DevOps resources and security posture. Defender for DevOps processes and stores the following information:
Metadata on your connected source code management systems and associated repositories. This data includes user, organizational, and authentication information.
Scan results for recommendations and assessments results and details.
Data is stored within the region your connector is created in and flows into Microsoft Defender for Cloud. You should consider which region to create your connector in, for any data residency requirements as you design and create your DevOps connector.
Defender for DevOps currently doesn't process or store your code, build, and audit logs.
Learn more about Microsoft Privacy Statement.