--- title: CodeQL configuration slug: codeql-configuration docTags: createdAt: 2026-05-28T13:01:35.327Z --- # Configuring Git CodeQLis an industry-leading semantic code analysis engine that enables the discovery of vulnerabilities across your codebase. Configure  DevOps Intelligence to connect to CodeQL to pull security and vulnerability data from the security the security tool. Use the following guide. Before configuring DevOps Intelligence for Code QL, you must first configure your Git applications. ## GitHub - **Name:** Local account name. It could be any string and is used only for reference. - **User:** Username for Git. Generally, the login email ID. - **Token:** Personal access token. Can be generated from the following\:settings --> developer options --> personal access token. Scope type Name Description repo - repo\:status - repo\_deployment - public\_repo - repo\:invite - security\_events - **Full control of private repositories** write\:packages read\:packages Download packages from GitHub Package Registry admin\:org read\:org Read organization and team membership, read organization projects admin\:repo\_hook read\:repo\_hook Read repository hooks admin\:public\_key read\:public\_key Read user public keys write discussion read\:discussion Read team discussions user - read\:user - user\:email - user\:follow :::Paragraph{indent="1"} Update ALL user data ::: - Provide repository permissions by navigating GitHub repository main page --> Settings --> Code security and analysis --> Access to alerts and typing the user's name in the search field, and click the correct user from the display list. ## GitHub Enterprise - **Name:** Local account name. Any string is valid; only for reference. - **Host:** Git API URL of the Git Host. For example, API url such as https\://github.abc.net/ - **User:** Username for GIT. Generally the email ID with which user logged in to Git. - **Token:**Personal access token. Can be generated from the following: Settings --> developer options --> personal access token The personal access token requires the following permissions: | **Scope type** | **Name** | **Description** | | ------------------------------------------- | ------------------------------------------------------------------------------ | -------------------------------------------------------------------------- | | repo | - repo\:status
- repo\_deployment
- public\_repo
- repo\:invite | Full control of private repositories | | admin\:org | read\:org | Read organization and team membership | | admin\:repo\_hook | - write: repo\_hook
- read\:repo\_hook | Full control of repository hooks | | admin\:org\_hook | admin\:org\_hook | Full control of organization hooks | | notifications | notifications | Access notifications | | write discussion | read\:discussion | Read team discussions | | admin\:pre\_received\_hook | admin\:pre\_received\_hook | Control enforcement of pre-receive hooks for an organization or repository | - For both GitHub and GitHub Enterprise you must add a DevOps Intelligence connection.  Click Admin --> IAM --> Connections --> **Add New** button. Select **Add Connection**. ## GitLab - **Name:** Local connection name. It could be any string and is used only for reference. - **User:** Username for GIT. Generally the email ID with which user logged in to GIT. - **Token:** Personal access token. Generated using the following: Settings --> access token The personal access token requires the API permissions ## GitLab Enterprise - **Name:** Local connection name. It could be any string and is used only for reference - **Host** Git API URL of the Git Host. For example, API url such as https\://github.abc.net/ - **User** Username for GIT. Generally the email ID with which user logged in to GIT - **ProxyID:**(Optional) Use UUID for Proxy Adapter - **Token:** Personal access token. Generate from settings --> access tokens The personal access token requires the API permission - For both GitLab and GitLab Enterprise you must add a DevOps Intelligence connection.  Click Admin --> IAM --> Connections --> **Add New** button. Select **Add Connection**. When the syncall is enabled, all the organization and repositories for which the user has access will be synced. # Configuring DevOps Intelligence for Code QL, recent customers :::hint{type="info"} The procedures in this section are valid only for customers onboarded 6 June 2024 or after. Procedures for legacy customers are provided in the subsequent section *Configuring * DevOps Intelligence * for Code QL, legacy customers*. ::: Use the following procedure to configure the DevOps Intelligence for Code QL: :::hint{type="info"} Tools must be configured for a specific application in a specific DevOps phase. In step 2 of the following procedure, you are choosing the application and DevOps phase to associate with Azure Pipeline as part of the configuration procedure. ::: 1. Click** Settings & Utilities** → **Application Configuration**. You will see a list of existing applications. 2. Select the existing application for which you want to configure Azure Pipelines or create a new application. 3. Click the overflow menu (vertical ellipsis) on the Build row for the selected application. 4. Select **Add New Tool Configuration** from the overflow menu. The service displays the **Add Tool Configuration** form. 5. Select **Scan** for **Secure Categories**. The service displays the **Tool Engine** field. 6. Select Code QL for **Tool Engine**. The service displays the release ID fields, which are prepopulated. 7. Click **Submit**. # Onboarding the Code QL technical service After configuring DevOps Intelligence for Code QL, you must onboard Code QL as a technical service. Use the following procedure: 1. Click the overflow menu for the selected application. 2. Select **Onboard Technical Service**. The service displays the Onboard Technical Service form. 3. Select **Static Scan** for **DevOps Phase**. The service displays the Tool Engine field. 4. Select **Code QL** for **Tool Engine**. The service displays the **Select Connection** field. 5. Select the appropriate connection. The service displays the **Select Organization** field. 6. Select the appropriate organization. The service displays the **Select Projects** field. 7. Select the appropriate project. The service displays the Repository Name field. 8. Select the appropriate repository. 9. Click **Onboard**. The service navigates to the Application Configuration page. 10. You now have the option of clicking the overflow menu for Develop and selecting **Edit/Delete Tools Configuration** to confirm that DevOps Intelligence has been fully configured for CodeQL. # Deleting Code QL as a technical service The administrator may, at will, delete the Code QL technical service. Use the following procedure: 1. Navigate to DevOps Intelligence → **Settings & Utilities** → **Application Configuration**. 2. Expand the application to view all associated phases. 3. Click the Overflow menu for **Secure**. 4. Click **Delete Technical Service**. 5. Click **Code QL** for **Select Tools Configured**. The service displays the **Select Organization** field. 6. Select the appropriate organization. The service displays the **Select Projects** field. 7. Select the appropriate project. 8. Click **Delete**. # Configuring DevOps Intelligence for Code QL, legacy customers :::hint{type="info"} The procedures in this section are valid only for customers onboarded before 6 June 2024. ::: Prerequisite: Before configuring DevOps Intelligence for CodeQL, ensure the proper roles have been assigned. The user must have the **view, create, update,** and **delete** roles respectively to view, create, update and delete the BYO template data. These roles are provided by default to the Editor. Only viewer role will be provided to the Viewer. Select the Organization name and Repository name to fetch the vulnerabilities from and Additional configurations for customizations, to create the configuration. Only organizations and repositories owned by user will be displayed in the dropdown. If there are no vulnerabilities in any repository or if code-scanning is not configured for that repository, then sync page shows error indicating that the "Endpoint data not found".