How should Advanced Security Dependency Scanning be configured for a multi-module Maven project in Azure?

For this scenario, configure dependency scanning as an explicit pipeline step and scope it to the checked-out source tree that contains the Maven project being built.

1. Run the scan after the Maven build steps and before any cleanup. The task guidance is to place AdvancedSecurity-Dependency-Scanning@1 after build steps for the most accurate results.
2. Point the scan at the directory that contains the checked-out multi-repo Maven workspace. By default, dependency scanning processes Agent.BuildDirectory. If the effective Maven project is under a specific folder such as $(Agent.BuildDirectory)/modules, set DependencyScanning.SourcePath to that directory so the task analyzes the intended files. Example:

      - task: AdvancedSecurity-Dependency-Scanning@1
        env:
          DependencyScanning.SourcePath: $(Agent.BuildDirectory)/modules
   

3. Scan the root aggregator location, not only the deployable WAR module. Dependency scanning detects vulnerable direct and transitive open-source components used by the codebase. For a multi-module Maven build rooted at an aggregator POM, the recommended target is the root directory for that build so the full dependency graph can be evaluated, rather than limiting the scan to only one deployable module.
4. Build first, then scan. A Maven build before the scan is the supported placement. A clean install is not explicitly required by the task documentation, but the scan should run after the build steps complete and before cleanup.
5. If the pipeline definition is in one repository and the scanned source is in another, enable repository inference for publishing results to the intended repository. Set:

      advancedsecurity.publish.repository.infer: true
   

   If pull request annotations are missing when using inferred or alternate publishing, also set:

      DependencyScanning.SourcePath: $(System.DefaultWorkingDirectory)
   

6. Do not add multiple dependency scanning task executions in the same pipeline job. Multiple executions in the same job are not supported. If the scan path is scoped to a subdirectory, the task cannot be added again in that job to scan a different directory.
7. Verify prerequisites.
   • The repository being scanned must have GitHub Advanced Security for Azure DevOps enabled.
   • The task is supported only with Azure Repos Git repositories.
   • Agent version must be 2.209.0 or greater.
   • If permissions were customized, grant the pipeline build service account Advanced Security: View Alerts.

On the specific questions:

• Default setting turned off: the documentation provided does not state that the default setup must be turned off. The supported guidance is to use a pipeline containing AdvancedSecurity-Dependency-Scanning@1; enabling Advanced Security alone does not run scanning automatically.
• Root aggregator POM or WAR module: use the root aggregator project directory for the multi-module build.
• clean install or something else before scan: run the dependency scanning task after the Maven build steps and before cleanup. The documentation does not require clean install specifically.

If scans are timing out in a large multi-module workspace, increase the timeout:

- task: AdvancedSecurity-Dependency-Scanning@1
  env:
    DependencyScanning.Timeout: 600

References:

• AdvancedSecurity-Dependency-Scanning@1 - Advanced Security Dependency Scanning v1 task
• Troubleshoot dependency scanning
• Set up dependency scanning