Merge branch 'users/glmorale/sprint271releasenotes' of https://github.com/MicrosoftDocs/azure-devops-docs-pr into users/glmorale/sprint271releasenotes

Author: gloridelmorales

release-notes/2026/includes/ghazdo/sprint-271-update-links.md

@@ -5,4 +5,6 @@ ms.date: 3/31/2026
 ms.topic: include
 ---
 
-- [Permissions enforcement in security overview](#permissions-enforcement-in-security-overview)
+- [Advanced Security status checks for pull requests](#advanced-security-status-checks-for-pull-requests)
+- [Export results from security overview](#export-results-from-security-overview)
+- [Audit log events for Advanced Security enablement changes](#audit-log-events-for-advanced-security-enablement-changes)

release-notes/2026/includes/ghazdo/sprint-271-update.md

@@ -5,6 +5,40 @@ ms.date: 3/31/2026
 ms.topic: include
 ---
 
-### Permissions enforcement in security overview
+### Advanced Security status checks for pull requests
 
-Security overview now enforces the **Advanced Security: Read alerts** permission across all views (Risk and Coverage). Repositories where the current user lacks this permission are no longer visible in security overview results. This change ensures that security overview respects the same access controls as the repository-level alerts experience, preventing unauthorized visibility into which repositories have active findings.
+Advanced Security now publishes configurable status checks that integrate with Azure DevOps' built-in branch policy system. When Advanced Security scanning runs against a pull request, it automatically publishes status checks that can be used as required branch policies.
+
+Two new status checks are available:
+
+- **AdvancedSecurity/NewHighAndCritical** — fails only when the pull request introduces new high or critical severity alerts, ignoring pre-existing findings in the target branch.
+- **AdvancedSecurity/AllHighAndCritical** — fails when there are any high or critical severity alerts present, including pre-existing alerts in the target branch.
+
+Status checks use fail-open behavior: repositories where Advanced Security is not enabled pass the check automatically, preventing workflow blocking for non-onboarded repositories.
+
+To use these status checks, add them as required status policies on your branches through the branch policy settings. For more information and setup, see [Advanced Security status checks](https://aka.ms/ghazdo-status-checks).
+
+> [!div class="mx-imgBorder"]
+> [![Screenshot of the Add status policy dialog showing AdvancedSecurity status checks.](../../media/271-ghazdo-01.png "Screenshot of the Add status policy dialog showing AdvancedSecurity status checks.")](../../media/271-ghazdo-01.png#lightbox)
+
+### Export results from security overview
+
+You can now export results from security overview to a CSV file. Both the Risk and Coverage views support export, giving you a downloadable snapshot of your organization's security posture across repositories. The upcoming Alerts page, which gives you insight into specific alerts across your organization, will also support export functionality with a max of the first 1,000 alerts exported.
+
+This feature is only available via the UI at this time.
+
+> [!div class="mx-imgBorder"]
+> [![Screenshot of the export button in security overview.](../../media/271-ghazdo-02.png "Screenshot of the export button in security overview.")](../../media/271-ghazdo-02.png#lightbox)
+
+### Audit log events for Advanced Security enablement changes
+
+Azure DevOps now records audit log events whenever GitHub Advanced Security enablement settings change. When Advanced Security features are enabled or disabled at the repository, project, or organization level, a detailed event is captured in the [Azure DevOps audit log](/azure/devops/organizations/audit/azure-devops-auditing).
+
+Audit log entries include the actor, timestamp, and the specific settings that were modified, including:
+
+- Advanced Security (bundled) or Code Security/Secret Protection plans (standalone)
+- CodeQL default setup
+- Dependency scanning default setup
+- Secret push protection
+
+These events provide visibility into when and by whom security features are configured across your organization, supporting compliance and governance requirements.

release-notes/2026/media/271-ghazdo-01.png

@@ -38,8 +38,10 @@ You can also [view the build numbers for each version](#azure-devops-server-buil
         </tr>
     </thead>
 <tr>
-    <td rowspan="8"><a href="2026/sprint-271-update.md" data-raw-source="[31 March 2026](2026/sprint-271-update.md)">March 31 2026</a></td>
+    <td rowspan="10"><a href="2026/sprint-271-update.md" data-raw-source="[31 March 2026](2026/sprint-271-update.md)">March 31 2026</a></td>
     <td>Permissions enforcement in security overview</td><td>GitHub Advanced Security for Azure DevOps</td><td>N/A</td></tr>
+    <td>Advanced Security status checks for pull requests</td><td>GitHub Advanced Security for Azure DevOps</td><td>N/A</td></tr>
+    <td>Export results from security overview</td><td>GitHub Advanced Security for Azure DevOps</td><td>N/A</td></tr>
     <td>Remote MCP Server Public Preview</td><td>General</td><td>Future</td></tr>
     <td>Expired personal access tokens (PATs) can no longer be modified</td><td>General</td><td>Future</td></tr>
     <td>Allow extensions to access local network resources</td><td>General</td><td>Future</td></tr>