Onboarding
Onboarding connects your code, identifies the repositories to review first, and gives Nullify the context it needs to prioritize findings. Start from the setup page after your workspace access exists. A new Azure DevOps workspace is opened with the setup invitation, not the Request workspace button. The current dashboard uses the stages below; enabled integrations and features determine which optional steps appear.
Screenshots use sample data from the current dashboard; optional steps vary by tenant.
Before you start
Have an administrator available to authorize source-control and workflow integrations. Decide which repositories belong in the first review, which cloud accounts are in scope, and who should receive security questions. For runtime testing, prepare a non-production target and dedicated test credentials; see Preparing for an Engagement.
Setup stages
Welcome
Review what setup will do and continue.
Codebases
Connect GitHub, or Azure DevOps when offered by your integration catalog. Azure Boards ticketing credentials alone do not connect source code. GitLab and Bitbucket installation is handled through their enterprise guides rather than a wizard connection panel.
Repositories
Search the repository inventory, review recommendations, and select the repositories to enroll. Installation access and enrollment are separate: an accessible repository is not necessarily selected for review. Trial or tenant limits can restrict enrollment.
Workflow
Connect Slack for conversations and Jira, Linear, or Azure DevOps for tickets. You can add other supported connectors later in settings.
Builds
Connect Jenkins or Buildkite to provide build context.
Cloud
Connect AWS, Google Cloud, Azure, or Kubernetes. Authorize only the accounts and clusters you intend Nullify to assess.
Policy, when enabled
Review remediation SLAs. See Ticketing and SLAs.
Assessment
Select applications and credentials for runtime testing. Adding a target does not itself authorize destructive testing.
Bug bounty, when enabled
Review program scope and rules of engagement. Confirm an imported program before saving it.
Documents
Upload architecture, ownership, security-policy, and business-context documents.
Your business
Describe the organization, critical systems, responsibilities, and priorities.
Finish
Review the selected integrations and repositories, then submit setup.
Submission starts the onboarding pipeline. The live setup workspace shows progress, completed work, and any steps needing attention. Closing the browser does not stop it. A partial or failed run is not a completed onboarding: use the displayed recovery action or contact Nullify. Access to the product also depends on your installation's approval and readiness state.
After setup
Review your action items, verify ownership, and confirm the PR gate, ticketing, and notification settings before relying on automation.
Workspace sign-in is configured separately from repository access. Follow Microsoft Entra SSO and SCIM for directory consent, member activation/linking, provisioning and safe Entra-only cutover. For Azure DevOps, complete the installation checklist and verify the first scan; a Microsoft sign-in or Azure Boards credential alone does not connect repositories.
Self-hosted service domains, where supported by your tenant's connector settings, tell credential validation which service endpoint to use. Enter your actual service hostname rather than assuming a cloud provider's public endpoint applies.
Revising setup
Reopening onboarding lets you revise the setup, including connections, repository selection, and questionnaire answers. Review the summary before resubmitting; this can restart context-building work. Updated context informs subsequent processing, but does not guarantee that every previously reviewed finding is automatically re-triaged. Use the relevant finding's re-triage workflow when an existing decision needs reconsideration.
Dashboard versions
Older tenants may still show Configure navigation and a longer sequence of separate setup screens. This guide follows the current dashboard. If a named optional step is absent, use the matching connector or API guide rather than treating its absence as proof that setup failed.
Last updated