Org-wide ADO visibility. Zero infra.
Branch-policy compliance and governance for Azure DevOps — org-wide visibility that supports your CMMC, SOC 2, and NIST 800-171 evidence. No backend, no PATs, no secrets stored. Every scan runs as your authenticated ADO session.
How it works
Three steps, no deployment
01 — Install
Install Primed Toolkit from the Azure DevOps Marketplace.
02 — Open
Open the Primed Toolkit hub from your project's hub group.
03 — Scan
Run a scan. It executes as your ADO session and results are cached per-user in extension storage — each user sees only their own scan.
The hubs
Four tools inside one extension
Branch Policy Compliance
FreeAzure DevOps configures branch policies per-repo, per-branch, but gives you no org-wide view. Primed Toolkit answers "which repos require code review on main?" automatically.
- Org-wide audit of every repo across every project
- Compliance scoring against your standard (e.g. 1+ reviewers and build validation)
- Traffic-light status — compliant / partial / non-compliant / no-default-branch
- Missing-policy identification — exactly what each repo lacks
- CSV / JSON export for an auditor or an evidence pipeline
DORA Metrics
ProAn on-demand snapshot of three DORA metrics for one pipeline, read from your Azure Pipelines run history — no extra setup.
- Deployment frequency for a chosen pipeline and branch
- Change-failure rate and time to restore, from run outcomes
- DORA reference bands for orientation, on demand
Pipeline Performance
ProSee where your pipeline time and reliability actually go, across a project's pipelines.
- Median and p95 run duration per pipeline
- Success rate per pipeline, from build history
- Slowest stages for a pipeline, on demand
Service Connection Audit
ProInventory every service connection across your org and flag which still authenticate with a stored secret instead of a federated or managed identity — the configuration evidence CMMC and SOC 2 auditors ask for.
- Org-wide inventory of every service connection
- Flag stored-secret credentials vs. federated / managed identity
- Spot shared and not-ready connections
Required permissions
The extension only ever surfaces what your own ADO session can already see
Project (Read)
To enumerate projects.
Code (Read)
To enumerate repositories and read branch policies.
Service Connections (Read)
For the Service Connection Audit (Pro).
To scan all projects org-wide, your account needs Read access to each project. No PATs are used and no secrets are stored — see our privacy policy for details.
On the roadmap
Not shipped yet
Drift Alerts — get notified when a repo's policy posture changes. Not built yet; we're gauging interest first. Request early access →