How do you collect SOC 2 and ISO 27001 evidence from Azure DevOps?

A read-scoped access token that you create and control. Scans read project configuration, policies, and role assignments; code is never persisted, and you can revoke the token at any time.

They cover different layers. The Azure integration scans your subscription infrastructure; this one covers the software delivery chain: branch policies, pipelines, and project access. Both feed the same control catalog, so nothing is collected twice.

Vera opens a ticket describing the failing configuration and re-verifies after a human applies the fix. Nothing in your projects is changed by Screenata; the connection is read-only by construction.

First, create a read-scoped access token covering the projects in scope and connect it. Second, let the first scan run so the baseline reflects how your repositories and pipelines are actually configured. Third, fix what fails: enable a blocking branch policy on every active default branch, set a minimum reviewer count of at least one and block self-approval, reset approvals when new commits are pushed, put an approval or environment gate in front of production deploys, move any plaintext secrets out of pipeline YAML into secret variables or variable groups, and scope service connections to the project that uses them. Fourth, leave the scheduled scans running so passing results accumulate as signed evidence across the observation window, which for a Type 2 report is usually three to twelve months. Fifth, hand the evidence package to an independent auditor. The audit is a separate engagement with a licensed CPA firm, which issues the report; Screenata prepares and holds the evidence it asks for.

They pick a sample of merged changes and expect four things for each one. That a review happened before the merge, not after. That an enforced branch policy made the review mandatory rather than a convention people follow. That the approver was someone other than the author. And that the record covers the whole audit period, not a screenshot taken the week before fieldwork. Default branch protected by policy and Minimum reviewer count show the enforcement and the block on self-approval, Approvals reset on new commits shows the approval applied to the code that actually merged, and the pipeline approval or environment gate shows the deploy itself was authorized.

Yes. Every finding is exported as a signed, timestamped artifact, a SHA-256 hash with an RSA or ECDSA signature and an RFC 3161 timestamp, that an auditor verifies outside Screenata with a free CLI. A person reviews and approves the evidence before it reaches the auditor. Screenata collects and signs it; it does not decide the audit result.