ADO Branch Policy Violation Alert

Overview

This flow monitors Azure DevOps repositories for direct pushes to protected branches (main, master, release/*) that bypass branch policies. When a push is detected that did not originate from a pull request merge, the flow sends immediate alerts to both a Microsoft Teams security channel and a Slack developer channel. Alerts include the committer name, branch, commit hash, and repository details.

Use Case

Branch policies are a critical guardrail in Azure DevOps — they enforce pull request reviews, build validation, and approval gates before code lands on protected branches. However, administrators or users with elevated permissions can bypass these policies with direct pushes. This flow provides a real-time detection and notification layer so that security and development teams are immediately aware when a bypass occurs, enabling rapid investigation and remediation.

Trigger scenario: A developer force-pushes directly to main without going through a pull request. Within 5 minutes, the flow detects the push event, determines it was not a PR merge commit, and fires alerts to Teams and Slack with full context.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Activate the flow

Navigate to the FlowLibsAdoBranchPolicyViolationAlert solution in make.powerautomate.com, open the flow, and click Turn on. Ensure all six environment variables have current values for your target environment, and verify the three connection references (Azure DevOps, Teams, Slack) are authenticated with valid credentials.

Adapt for different protected branches

Modify the Check_If_Protected_Branch condition to include or exclude branch patterns. The default logic matches branches starting with main, master, or release/. Add startsWith() clauses to the @or() expression to cover additional patterns such as hotfix/ or develop.

Add additional notification channels

Add new actions after the Teams and Slack posts inside the 'not a PR merge' branch. Follow the connector-first pattern — use a real connector action (e.g., Outlook SendEmail, PagerDuty CreateIncident) rather than the built-in HTTP action so the flow keeps consistent auth and retry behavior.

Change the polling interval

Update the trigger's recurrence object. The current setting is frequency: Minute, interval: 5. Lower the interval for faster detection (at the cost of more API calls) or raise it for noisier repos.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

replace(triggerBody()?['resource']?['refUpdates'][0]?['name'], 'refs/heads/', '')

@or(startsWith(outputs('Compose_Branch_Name'), 'main'), startsWith(outputs('Compose_Branch_Name'), 'master'), startsWith(outputs('Compose_Branch_Name'), 'release/'))

@not(startsWith(body('Parse_Push_Details')?['commits'][0]?['comment'], 'Merged PR'))

@parameters('flowlibs_AdoOrganization (flowlibs_adoorganization)')