Get Started with Qualys TotalAppSec Scanning Connector for Azure DevOps
Release 1.0.0
July 15, 2026
The Qualys TotalAppSec Scanning Connector integrates Azure Pipelines CI/CD with the Qualys TotalAppSec (TAS) module. This extension enables automated vulnerability scanning for both web applications and API-type applications, streamlining security checks during development.
It empowers DevOps teams to seamlessly incorporate application vulnerability scans into their Azure Pipeline workflows. Integrating security scans into the CI/CD process allows application security testing to be performed earlier in the software development life cycle (SDLC), reducing the risk of vulnerabilities reaching production.
The extension can be configured to pass or fail builds based on vulnerabilities detected during the scan, enabling automated enforcement of security standards. It also generates detailed scan reports in both JSON and PDF formats for each build, supporting compliance and audit requirements.
QualysTAS Scanning Connector Workflow
Prerequisites
The following prerequisites must be met:
-
A valid Qualys TotalAppSec subscription with API access is required.
You have pre-configured web applications and API's, an option profile, and an authentication record in your Qualys TAS account. -
The current version of the Web App Scanning Connector supports only Azure DevOps Services. You can use self-hosted agents or Microsoft agents.
Quick Start Steps
Additional Resources
- For information on using the TAS UI to monitor vulnerabilities in web applications, refer to the Qualys TotalAppSec Help.
- For information on using the Web Application Scanning API, refer to the Web Application Scanning API User Guide.