diff --git a/.gitignore b/.gitignore
index 2450a0de6..d41b961a4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,7 +18,6 @@
 x64/
 x86/
 ARM64/
-build/
 bld/
 [Bb]in/
 [Oo]bj/
diff --git a/build/pipelines/ci.yml b/build/pipelines/ci.yml
index 0faa383b7..0900e5241 100644
--- a/build/pipelines/ci.yml
+++ b/build/pipelines/ci.yml
@@ -19,6 +19,10 @@ pr:
 name: 0.0.$(Date:yyMM).$(Date:dd)$(Rev:rr)
 
 jobs:
+  - template: ./templates/build-console-audit-job.yml
+    parameters:
+      platform: x64
+
   - template: ./templates/build-console-ci.yml
     parameters:
       platform: x64
diff --git a/build/pipelines/release.yml b/build/pipelines/release.yml
index 126b3dc08..31365ae66 100644
--- a/build/pipelines/release.yml
+++ b/build/pipelines/release.yml
@@ -16,6 +16,10 @@ variables:
 name: 'Terminal_$(date:yyMM).$(date:dd)$(rev:rrr)'
 
 jobs:
+  - template: ./templates/build-console-audit-job.yml
+    parameters:
+      platform: x64
+
   - template: ./templates/build-console-int.yml
     parameters:
       platform: x64
diff --git a/build/pipelines/templates/build-console-audit-job.yml b/build/pipelines/templates/build-console-audit-job.yml
new file mode 100644
index 000000000..b5bb0699c
--- /dev/null
+++ b/build/pipelines/templates/build-console-audit-job.yml
@@ -0,0 +1,53 @@
+parameters:
+  platform: ''
+  additionalBuildArguments: ''
+
+jobs:
+- job: Build${{ parameters.platform }}AuditMode
+  displayName: Static Analysis Build ${{ parameters.platform }}
+  variables:
+    BuildConfiguration: AuditMode
+    BuildPlatform: ${{ parameters.platform }}
+  pool: { vmImage: vs2017-win2016 }
+
+  steps:
+  - checkout: self
+    submodules: true
+    clean: true
+
+  - task: NuGetToolInstaller@0
+    displayName: Ensure NuGet 4.8.1
+    inputs:
+      versionSpec: 4.8.1
+
+  # In the Microsoft Azure DevOps tenant, NuGetCommand is ambiguous.
+  # This should be `task: NuGetCommand@2`
+  - task: 333b11bd-d341-40d9-afcf-b32d5ce6f23b@2
+    displayName: Restore NuGet packages
+    inputs:
+      command: restore
+      feedsToUse: config
+      configPath: NuGet.config
+      restoreSolution: OpenConsole.sln
+      restoreDirectory: '$(Build.SourcesDirectory)\packages'
+
+  - task: 333b11bd-d341-40d9-afcf-b32d5ce6f23b@2
+    displayName: 'NuGet restore packages for CI'
+    inputs:
+      command: restore
+      restoreSolution: build/.nuget/packages.config
+      feedsToUse: config
+      externalFeedCredentials: 'TAEF NuGet Feed'
+      nugetConfigPath: build/config/NuGet.config
+      restoreDirectory: '$(Build.SourcesDirectory)/packages'
+
+  - task: VSBuild@1
+    displayName: 'Build solution **\OpenConsole.sln'
+    inputs:
+      solution: '**\OpenConsole.sln'
+      vsVersion: 15.0
+      platform: '$(BuildPlatform)'
+      configuration: '$(BuildConfiguration)'
+      msbuildArgs: ${{ parameters.additionalBuildArguments }}
+      clean: true
+      maximumCpuCount: true
diff --git a/build/pipelines/templates/build-console-ci.yml b/build/pipelines/templates/build-console-ci.yml
index f8de3d181..a4ac7b6d8 100644
--- a/build/pipelines/templates/build-console-ci.yml
+++ b/build/pipelines/templates/build-console-ci.yml
@@ -4,8 +4,8 @@ parameters:
   additionalBuildArguments: ''
 
 jobs:
-- job: Build${{ parameters.platform }}
-  displayName: Build ${{ parameters.platform }}
+- job: Build${{ parameters.platform }}${{ parameters.configuration }}
+  displayName: Build ${{ parameters.platform }} ${{ parameters.configuration }}
   variables:
     BuildConfiguration: ${{ parameters.configuration }}
     BuildPlatform: ${{ parameters.platform }}
diff --git a/build/pipelines/templates/build-console-int.yml b/build/pipelines/templates/build-console-int.yml
index 708915f8d..bf8664d15 100644
--- a/build/pipelines/templates/build-console-int.yml
+++ b/build/pipelines/templates/build-console-int.yml
@@ -4,8 +4,8 @@ parameters:
   additionalBuildArguments: ''
 
 jobs:
-- job: Build${{ parameters.platform }}
-  displayName: Build ${{ parameters.platform }}
+- job: Build${{ parameters.platform }}${{ parameters.configuration }}
+  displayName: Build ${{ parameters.platform }} ${{ parameters.configuration }}
   variables:
     BuildConfiguration: ${{ parameters.configuration }}
     BuildPlatform: ${{ parameters.platform }}
diff --git a/build/pipelines/templates/release-sign-and-bundle.yml b/build/pipelines/templates/release-sign-and-bundle.yml
index 07e578a25..105b834d4 100644
--- a/build/pipelines/templates/release-sign-and-bundle.yml
+++ b/build/pipelines/templates/release-sign-and-bundle.yml
@@ -6,16 +6,18 @@ jobs:
   displayName: Sign and Deploy for ${{ parameters.configuration }}
 
   dependsOn:
-    - Buildx64
-    - Buildx86
-    - Buildarm64
+    - Buildx64AuditMode
+    - Buildx64Release
+    - Buildx86Release
+    - Buildarm64Release
   condition: |
     and
     (
-      in(dependencies.Buildx64.result,   'Succeeded', 'SucceededWithIssues', 'Skipped'),
-      in(dependencies.Buildx86.result,   'Succeeded', 'SucceededWithIssues', 'Skipped'),
-      in(dependencies.Buildarm64.result, 'Succeeded', 'SucceededWithIssues', 'Skipped')
-    ) 
+      in(dependencies.Buildx64AuditMode.result, 'Succeeded', 'SucceededWithIssues', 'Skipped'),
+      in(dependencies.Buildx64Release.result,   'Succeeded', 'SucceededWithIssues', 'Skipped'),
+      in(dependencies.Buildx86Release.result,   'Succeeded', 'SucceededWithIssues', 'Skipped'),
+      in(dependencies.Buildarm64Release.result, 'Succeeded', 'SucceededWithIssues', 'Skipped')
+    )
 
   variables:
     BuildConfiguration: ${{ parameters.configuration }}
diff --git a/src/StaticAnalysis.ruleset b/src/StaticAnalysis.ruleset
index 1eea1e89f..e9d2a69ed 100644
--- a/src/StaticAnalysis.ruleset
+++ b/src/StaticAnalysis.ruleset
@@ -1,4 +1,11 @@
 <?xml version="1.0" encoding="utf-8"?>
 <RuleSet Name="Console Rules" Description="These rules enforce static analysis on console code." ToolsVersion="15.0">
+
   <Include Path="cppcorecheckrules.ruleset" Action="Default" />
+
+  <Rules AnalyzerId="Microsoft.Analyzers.NativeCodeAnalysis" RuleNamespace="Microsoft.Rules.Native">
+    <Rule Id="C6001" Action="Error" />
+    <Rule Id="C6011" Action="Error" />
+  </Rules>
+
 </RuleSet>
diff --git a/src/buffer/out/precomp.h b/src/buffer/out/precomp.h
index 4c6505cc1..adb1cfb93 100644
--- a/src/buffer/out/precomp.h
+++ b/src/buffer/out/precomp.h
@@ -21,7 +21,6 @@ Abstract:
 #include "LibraryIncludes.h"
 
 #pragma warning(push)
-#pragma warning(disable: ALL_CPPCORECHECK_WARNINGS)
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN             // Exclude rarely-used stuff from Windows headers
 #endif
diff --git a/src/cascadia/TerminalApp/App.h b/src/cascadia/TerminalApp/App.h
index 584168da3..25638d354 100644
--- a/src/cascadia/TerminalApp/App.h
+++ b/src/cascadia/TerminalApp/App.h
@@ -8,8 +8,6 @@
 #include "App.g.h"
 #include "../../cascadia/inc/cppwinrt_utils.h"
 
-#include <wil/filesystem.h>
-
 #include <winrt/Microsoft.Terminal.TerminalControl.h>
 
 #include <winrt/Microsoft.UI.Xaml.Controls.h>
diff --git a/src/cascadia/TerminalApp/CascadiaSettingsSerialization.cpp b/src/cascadia/TerminalApp/CascadiaSettingsSerialization.cpp
index 28a0b955f..f8d88ad44 100644
--- a/src/cascadia/TerminalApp/CascadiaSettingsSerialization.cpp
+++ b/src/cascadia/TerminalApp/CascadiaSettingsSerialization.cpp
@@ -6,8 +6,6 @@
 #include "CascadiaSettings.h"
 #include "../../types/inc/utils.hpp"
 #include <appmodel.h>
-#include <wil/com.h>
-#include <wil/filesystem.h>
 #include <shlobj.h>
 
 using namespace ::TerminalApp;
diff --git a/src/cascadia/TerminalConnection/pch.h b/src/cascadia/TerminalConnection/pch.h
index 832645af3..04e2abdf5 100644
--- a/src/cascadia/TerminalConnection/pch.h
+++ b/src/cascadia/TerminalConnection/pch.h
@@ -14,4 +14,3 @@
 
 #include "winrt/Windows.Foundation.h"
 #include <Windows.h>
-#include <wil/result.h>
diff --git a/src/common.build.post.props b/src/common.build.post.props
index 00a81388c..5539b05ee 100644
--- a/src/common.build.post.props
+++ b/src/common.build.post.props
@@ -25,4 +25,9 @@
     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
   </ImportGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <!-- Exclude our dependencies from static analysis. CAExcludePath can only be
+       set after we've imported Microsoft.Cpp.targets -->
+  <PropertyGroup>
+    <CAExcludePath>$(SolutionDir)\dep\;$(CAExcludePath)</CAExcludePath>
+  </PropertyGroup>
 </Project>
diff --git a/src/common.build.pre.props b/src/common.build.pre.props
index 1591634fe..d7853a892 100644
--- a/src/common.build.pre.props
+++ b/src/common.build.pre.props
@@ -113,8 +113,8 @@
       <PreprocessorDefinitions>WIN32;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
   </ItemDefinitionGroup>
-    <!-- For our Audit mode -->
-   <PropertyGroup Condition="'$(Configuration)'=='AuditMode'">
+  <!-- For our Audit mode -->
+  <PropertyGroup Condition="'$(Configuration)'=='AuditMode'">
     <CodeAnalysisRuleSet>$(SolutionDir)\src\StaticAnalysis.ruleset</CodeAnalysisRuleSet>
     <EnableCppCoreCheck>true</EnableCppCoreCheck>
     <RunCodeAnalysis>true</RunCodeAnalysis>
diff --git a/src/inc/LibraryIncludes.h b/src/inc/LibraryIncludes.h
index e2a01094e..705a06237 100644
--- a/src/inc/LibraryIncludes.h
+++ b/src/inc/LibraryIncludes.h
@@ -3,10 +3,8 @@
 
 #pragma once
 
-#include <CppCoreCheck/Warnings.h>
 
 #pragma warning(push)
-#pragma warning(disable: ALL_CPPCORECHECK_WARNINGS)
 
 // C
 #include <climits>
@@ -44,12 +42,12 @@
 #include <functional>
 
 // WIL
-
 #include <wil/Common.h>
 #include <wil/Result.h>
 #include <wil/resource.h>
 #include <wil/wistd_memory.h>
 #include <wil/com.h>
+#include <wil/filesystem.h>
 
 // GSL
 // Block GSL Multi Span include because it both has C++17 deprecated iterators
@@ -57,6 +55,9 @@
 #define GSL_MULTI_SPAN_H
 #include <gsl/gsl>
 
+// CppCoreCheck
+#include <CppCoreCheck/Warnings.h>
+
 // IntSafe
 #define ENABLE_INTSAFE_SIGNED_FUNCTIONS
 #include <intsafe.h>
diff --git a/src/propsheet/precomp.h b/src/propsheet/precomp.h
index 6c44645f4..4b053c598 100644
--- a/src/propsheet/precomp.h
+++ b/src/propsheet/precomp.h
@@ -48,12 +48,7 @@
 #include "strid.h"
 #include "..\propslib\conpropsp.hpp"
 
-// WIL
 #include <new>
-#include <wil/Common.h>
-#include <wil/Result.h>
-#include <wil/resource.h>
-#include <wil/wistd_memory.h>
 
 // This is currently bubbling up the source tree to our branch
 #ifndef WM_DPICHANGED_BEFOREPARENT