Azure DevOps Autofix: preview phases, review gates and billing
The news at the time
Microsoft’s launch post describes Copilot Autofix for GitHub Advanced Security for Azure DevOps as a limited private preview with enrollment processed in waves. The launch post and later documentation must not be collapsed into an unchanged availability claim.
The launch workflow generates a suggested change from supported CodeQL alerts and opens a pull request. Existing review and build gates still run, and the alert resolves after merge and the next CodeQL scan.
Follow-up checked during renewal
At review time, the official guide labels the feature a limited public preview and says Microsoft is not accepting additional users. This is a later documented state, not evidence that the original private-preview wording was false.
The current guide says fix generation consumes AI credits billed through the linked Azure subscription, and GitHub Copilot budgets and user limits do not govern that Azure DevOps meter. License inclusion should not be read as free fix generation.
What to review before applying this
Check enrollment, supported alert types and the linked Azure subscription before enabling generation. Validate fixes manually and through tests; generating a suggestion does not itself remediate an alert.
Editorial review suggestions; no hands-on product experiment was performed.
Claim-by-claim source evidence
Microsoft’s launch post describes Copilot Autofix for GitHub Advanced Security for Azure DevOps as a limited private preview with enrollment processed in waves. The launch post and later documentation must not be collapsed into an unchanged availability claim.
Copilot Autofix is available today in limited private preview for GitHub Advanced Security for Azure DevOps.
Evidence source ↗
Enablement is processed in waves
Evidence source ↗
The launch workflow generates a suggested change from supported CodeQL alerts and opens a pull request. Existing review and build gates still run, and the alert resolves after merge and the next CodeQL scan.
Your usual review and build gates run on the pull request. Once it merges and the next CodeQL scan completes, the alert resolves on its own.
Evidence source ↗
At review time, the official guide labels the feature a limited public preview and says Microsoft is not accepting additional users. This is a later documented state, not evidence that the original private-preview wording was false.
This feature is in limited public preview. Microsoft isn't currently accepting additional users for the preview.
Evidence source ↗
The current guide says fix generation consumes AI credits billed through the linked Azure subscription, and GitHub Copilot budgets and user limits do not govern that Azure DevOps meter. License inclusion should not be read as free fix generation.
Generating a fix consumes AI credits from your organization's Azure billing meter.
Evidence source ↗
GitHub Copilot budget settings and user limits configured on GitHub don't apply to Copilot Autofix meter spend in Azure DevOps.
Evidence source ↗
Korean digest for the historical date: 2026-07-01. Quotations and source context were reviewed editorially; this is not an independent experimental verification.
Discussion