# Quickstart for Semgrep Managed Scans

Source: https://semgrep.dev/docs/getting-started/quickstart-managed-scans

- [](/docs/)- [Scan](/docs/getting-started/quickstart)- Get started- Quickstart: Managed Scans**On this page- [Quickstart](/docs/tags/quickstart)- [Semgrep AppSec Platform](/docs/tags/semgrep-app-sec-platform)Quickstart for Semgrep Managed Scans
Semgrep Managed Scans is the fastest method to scan projects at scale with Semgrep. With Semgrep Managed Scans, instead of adding Semgrep to your CI/CD pipeline, which requires a configuration file for each repository, Semgrep handles the scan process for all of the repositories you add.

infoA **project** is any codebase, repository, or folder within a monorepo that is added to Semgrep for scanning.

## Supported source code managers[​](#supported-source-code-managers)
You must be an existing Semgrep AppSec Platform user with:

- Bitbucket Cloud Premium plans or Bitbucket Data Center (v8.8 or above for diff-aware scans)
- Hosted GitHub (GitHub.com) and GitHub Enterprise Server plans
- GitLab Cloud and GitLab self-managed plans and a Premium or Ultimate subscription
- Azure DevOps Cloud repositories

## Add projects to Semgrep Managed Scans[​](#add-projects-to-semgrep-managed-scans)
- Azure DevOps- Bitbucket- GitHub- GitLab### Prerequisites[​](#prerequisites)You must have admin access to your Azure DevOps organization.

Read access is granted through an access token you generate on Azure DevOps. You can provide this token by [adding Azure DevOps as a source code manager](/docs/deployment/connect-scm#connect-to-cloud-hosted-orgs).

Semgrep recommends setting up and configuring Semgrep with an Azure DevOps service account, not a personal account. Regardless of whether you use a personal or service account, the account must be assigned the **Owner** or **Project Collection Administrator** role for the organization. During setup and configuration, you must provide a personal access token generated by this account. This token must be authorized with **Full access**. Once you have Semgrep Managed Scans fully configured, you can update the token provided to Semgrep to one that&#x27;s more restrictive. The scopes you must assign to the token include:

- `Code: Read`
- `Code: Status`
- `Member Entitlement Management: Read`
- `Project and Team: Read &amp; write`
- `Pull Request Threads: Read &amp; write`
### Add a project[​](#add-a-project)
- Sign in to [Semgrep AppSec Platform](https://semgrep.dev/login)
- Navigate to **Projects**, and click **Scan new project &gt; Semgrep Managed Scan**.
- In the **Enable Managed Scans for repos** page, select the repositories you want to add to Semgrep Managed Scans.
- Click **Enable Managed Scans**. The **Enable Managed Scans** dialog appears. By default, Semgrep runs both full and diff-aware scans.
- Click **Enable**. You are taken to the **Projects** page as your scans begin.
### Prerequisites[​](#prerequisites-1)You must have admin access to your GitHub organization.

To enable and use this feature, you must grant Semgrep **Read access** to your code. Steps are provided in [Add projects to Semgrep Managed Scans](#add-projects-to-semgrep-managed-scans).

Read access is permitted through a private Semgrep app that you create and register yourself. See [Managed Scans &gt; Security](/docs/deployment/managed-scanning/overview#security) for more information on how Semgrep handles your code.

### Add a project[​](#add-a-project-1)
- Navigate to [Semgrep AppSec Platform](https://semgrep.dev/login), and sign up by clicking on **Sign in with GitHub**. Follow the on-screen prompts to [grant Semgrep the necessary permissions](/docs/deployment/checklist#permissions) and proceed.
- Provide the **Organization display name** you&#x27;d like to use, then click **Create new organization**.
- When asked **Where do you want to scan?** click **GitHub**.
- Follow the steps in the **Connect GitHub to Semgrep** page. These steps install a public GitHub app, which handles PR comments, and a private GitHub app, which handles code access. You are able to select which repositories these apps have access to, and have full control over removing them or revoking their permissions.
- Click **Set up projects**. You are taken to the **Enable Managed Scans for repos** page.
- Select all the repositories you want to add to Semgrep Managed Scans for scanning.
- Click **Enable Managed Scans**. You are taken to the **Projects** page as your scans begin.
### Prerequisites[​](#prerequisites-2)Semgrep Managed Scanning (SMS) requires one of the following plans:

- GitLab Premium
- GitLab Ultimate
- GitLab Self Managed

You must provide a GitLab group access token or personal access token to Semgrep. The token must have the `api` scope assigned to it.

During SMS onboarding, the group or user to which the token is assigned must have one of the following roles:

- `Maintainer`
- `Owner`
- `Admin`

This is because managed scans of GitLab repositories require the enablement of webhooks to facilitate diff-aware scans and the creation of pull request comments by Semgrep. The webhooks are enabled by default when you set up Managed Scans and add GitLab as a source code manager. Once onboarding is complete, you can downgrade the role assigned to the token to `Developer`.

### Add a project[​](#add-a-project-2)
- Navigate to [Semgrep AppSec Platform](https://semgrep.dev/login), and sign up by clicking on **Sign in with GitLab**. Follow the on-screen prompts to proceed.
- When prompted, click **Scan new project &gt; Semgrep Managed Scan**.
- In the **Enable Managed Scans for repos** page, select the repositories you want to add to Semgrep Managed Scans.
- Click **Enable Managed Scans**. The **Enable Managed Scans** dialog appears. By default, Semgrep runs both full and diff-aware scans.
- Click **Enable**. You are taken to the **Projects** page as your scans begin.
### Prerequisites[​](#prerequisites-3)You must have admin access to your Bitbucket organization.

#### Bitbucket Cloud[​](#bitbucket-cloud)
- Read access is granted through a [workspace access token](https://support.atlassian.com/bitbucket-cloud/docs/workspace-access-tokens/) you generate on Bitbucket. You can provide this token by [adding Bitbucket as a source code manager](/docs/deployment/connect-scm#connect-to-cloud-hosted-orgs).
- The user generating the workspace token must be a **Product Admin** for the workspace. The scopes you must assign to the token include:

`webhook (read and write)`
- `repository (read and write)`
- `pullrequest (read and write)`
- `project (admin)`
- `account (read)`

#### Bitbucket Data Center[​](#bitbucket-data-center)
- V8.8 or above for diff-aware scans. Additionally, project-level webhooks are required to support diff-aware scans.
- Read access is granted through an [HTTP access token](https://confluence.atlassian.com/bitbucketserver/http-access-tokens-939515499.html) you generate on Bitbucket. You can provide this token by [adding Bitbucket as a source code manager](/docs/deployment/connect-scm#connect-to-on-premise-orgs-and-projects).
- The user generating the workspace token must be a **Product Admin** for the workspace. The token must be created with `PROJECT_ADMIN` permissions.
### Add a project[​](#add-a-project-3)
- Sign in to [Semgrep AppSec Platform](https://semgrep.dev/login)
- Navigate to **Projects**, and click **Scan new project &gt; Semgrep Managed Scan**.
- In the **Enable Managed Scans for repos** page, select the repositories you want to add to Semgrep Managed Scans.
- Click **Enable Managed Scans**. The **Enable Managed Scans** dialog appears. By default, Semgrep runs both full and diff-aware scans.
- Click **Enable**. You are taken to the **Projects** page as your scans begin.

You have finished setting up a Semgrep managed scan.

Here are some behaviors and characteristics of a managed scan:

- After enabling Managed Scans, Semgrep performs a full scan in batches on all the repositories that have been added to it.
- In general, once a git repository has been added to Semgrep AppSec Platform, it becomes a **project**. A project in Semgrep AppSec Platform includes all the findings, history, and scan metadata of that repository.
- Projects with a Managed Scan configuration are tagged with `managed-scan`, regardless of whether the project is actively being scanned by Semgrep Managed Scans or not.

## Next steps[​](#next-steps)
Once a scan has finished, you can view your findings by clicking any of the following on the navigation menu:

- [**  Code](https://semgrep.dev/orgs/-/findings?tab=open&amp;primary=true) for SAST findings
- [** Secrets](https://semgrep.dev/orgs/-/secrets?tab=open&amp;validation_state=confirmed_valid,validation_error,no_validator) for secrets findings
- [** Supply Chain](https://semgrep.dev/orgs/-/supply-chain/vulnerabilities?primary=true&amp;tab=open) for SCA findings

To learn more about how Semgrep manages your scans, read the in-depth [Semgrep Managed Scans documentation](/docs/deployment/managed-scanning/overview).

Not finding what you need in this doc? Ask questions in our [Community Slack group](https://go.semgrep.dev/slack), or see [Support](/docs/support/) for other ways to get help.

Tags:**- [Quickstart](/docs/tags/quickstart)- [Semgrep AppSec Platform](/docs/tags/semgrep-app-sec-platform)[Edit this page](https://github.com/semgrep/semgrep-docs/edit/main/docs/getting-started/quickstart-sms.md)Last updated on **Dec 2, 2025**