Microsoft supply chain coverage
In developmentYou have already bought more of this than you think. Just not all of it.
Pick what is on your purchase order. We will show you which software supply chain controls it already entitles, which ones sit in a SKU you do not hold, and where Microsoft has no answer and you will need somebody else.
No prices. Enterprise Microsoft is bought on negotiated rates, list moved in July 2026, and the published figures disagree with each other — so this measures coverage, which a discount does not change.
1 · What is on the purchase order?
12 SKUs modeled. Pick every one you hold, including the add-ons — the add-ons are usually where the argument is.
GitHub
GitHub Advanced Security
Microsoft Entra
Microsoft Sentinel
2 · What that covers, phase by phase
What you hold entitles 17 of 236 controls on the supply chain. Another 55 sit in Microsoft SKUs you did not select. The remaining 147 have no Microsoft answer at all — which puts Microsoft’s reachable ceiling at 72, about 31% of the field.
- You already pay for this
- Microsoft sells it, you do not hold it
- Microsoft has no answer
- Nobody we model does this
3 · Build, control by control
Build Provenance Attestation
BUILD · level 3
You already pay for this
GitHub Actions, GitHub Packages
Curated Hardened Action Catalog
CICD · level 4
You already pay for this
GitHub Actions
Ephemeral Isolated Build Runners
CICD · level 3
You already pay for this
GitHub Actions
Keyless Signing with Transparency Log
BUILD · level 3
You already pay for this
GitHub Actions
Pipeline Permission Minimization
CICD · level 2
You already pay for this
GitHub Actions
Third-Party Action & Plugin Pinning Enforcement
CICD · level 2
You already pay for this
GitHub Actions
Workload Identity Federation
SECRETS · level 3
You already pay for this
GitHub Actions
Artifact Signing
BUILD · level 2
Microsoft sells it, you do not hold it
In Azure DevOps Services
Code Signing Key Management
BUILD · level 3
Microsoft sells it, you do not hold it
In Azure DevOps Services
Code-to-Cloud Traceability
CLOUD · level 4
Microsoft sells it, you do not hold it
In Defender CSPM (Defender for Cloud)
Container Image Vulnerability Scanning
CONTAINER · level 2
Microsoft sells it, you do not hold it
In Defender for Containers (Defender for Cloud)
Dependency Curation & Allowlisting
DEPS · level 3
Microsoft sells it, you do not hold it
In Azure DevOps Services
Private Registry Proxy & Curation
REGISTRY · level 2
Microsoft sells it, you do not hold it
In Azure DevOps Services
Software Composition Analysis
DEPS · level 1
Microsoft sells it, you do not hold it
In GitHub Advanced Security for Azure DevOps, GitHub Code Security
Static Application Security Testing
SAST · level 2
Microsoft sells it, you do not hold it
In GitHub Advanced Security for Azure DevOps, GitHub Code Security
Taint & Data-Flow Analysis
SAST · level 3
Microsoft sells it, you do not hold it
In GitHub Code Security
Access Token Scoping & Least Privilege
SECRETS · level 2
Microsoft has no answer
AI Bill of Materials Generation
SBOM · level 4
Microsoft has no answer
AI Model File Scanning
AI · level 3
Microsoft has no answer
AI Model Provenance & Signing
AI · level 4
Microsoft has no answer
Artifact Chain-of-Custody Tracing
BUILD · level 4
Microsoft has no answer
Automated Evidence Collection
GRC · level 3
Microsoft has no answer
Base Image CVE Remediation Automation
CONTAINER · level 3
Microsoft has no answer
Binary & Bytecode Static Analysis
SAST · level 3
Microsoft has no answer
Build Egress Control & Network Monitoring
CICD · level 3
Microsoft has no answer
Centralized Secrets Management
SECRETS · level 2
Microsoft has no answer
CI/CD Configuration Scanning
CICD · level 2
Microsoft has no answer
Container Malware Scanning
CONTAINER · level 3
Microsoft has no answer
Continuous Image Rebuild & Freshness Management
CONTAINER · level 4
Microsoft has no answer
Dependency Confusion Prevention
DEPS · level 2
Microsoft has no answer
Dockerfile & Image Configuration Linting
CONTAINER · level 2
Microsoft has no answer
Dynamic Short-Lived Credentials
SECRETS · level 3
Microsoft has no answer
End-of-Life Component Detection
DEPS · level 2
Microsoft has no answer
Hermetic Build Enforcement
BUILD · level 5
Microsoft has no answer
IaC Misconfiguration Scanning
IAC · level 2
Microsoft has no answer
IaC Module & Provider Provenance Verification
IAC · level 4
Microsoft has no answer
Image Digest Pinning Enforcement
CONTAINER · level 2
Microsoft has no answer
Image Layer & Provenance Analysis
CONTAINER · level 3
Microsoft has no answer
Install Script & Package Behavior Analysis
DEPS · level 3
Microsoft has no answer
Kubernetes Manifest & Helm Chart Scanning
IAC · level 2
Microsoft has no answer
Maintainer & Publisher Risk Analysis
DEPS · level 3
Microsoft has no answer
Malicious Package Detection
DEPS · level 2
Microsoft has no answer
Minimal Hardened Base Images
CONTAINER · level 3
Microsoft has no answer
Minimum Release Age Enforcement
DEPS · level 3
Microsoft has no answer
Mobile Application Security Testing
SAST · level 3
Microsoft has no answer
Package Provenance Verification at Install
REGISTRY · level 4
Microsoft has no answer
Pipeline Runtime Anomaly Detection
CICD · level 4
Microsoft has no answer
Policy as Code Enforcement
GRC · level 3
Microsoft has no answer
Reachability Analysis
DEPS · level 3
Microsoft has no answer
Rebuilt-from-Source Dependency Provisioning
DEPS · level 5
Microsoft has no answer
Reproducible Build Verification
BUILD · level 5
Microsoft has no answer
SBOM Generation
SBOM · level 2
Microsoft has no answer
SBOM Quality & Completeness Validation
SBOM · level 3
Microsoft has no answer
SBOM Signing & Attestation
SBOM · level 4
Microsoft has no answer
Secrets Detection in CI Logs & Artifacts
SECRETS · level 3
Microsoft has no answer
Security Gate Orchestration
CICD · level 3
Microsoft has no answer
Signature Verification
BUILD · level 3
Microsoft has no answer
Supply Chain Layout Verification
BUILD · level 5
Microsoft has no answer
Transitive Dependency Resolution
DEPS · level 2
Microsoft has no answer
Unauthorized Code Change Detection
SCM · level 4
Microsoft has no answer
Workflow Injection Detection
CICD · level 2
Microsoft has no answer
Artifact Digest Integrity Verification
BUILD · level 2
Nobody we model does this
No product we model provides it.
Build Cache Poisoning Prevention
CICD · level 4
Nobody we model does this
No product we model provides it.
Dependency Pinning & Lockfile Integrity Verification
DEPS · level 2
Nobody we model does this
No product we model provides it.
Install Script Execution Restriction
DEPS · level 3
Nobody we model does this
No product we model provides it.
Training Data Poisoning Detection
AI · level 5
Nobody we model does this
No product we model provides it.
Untrusted Workflow Trigger Isolation
CICD · level 3
Nobody we model does this
No product we model provides it.
The part worth acting on first. Everything marked “you already pay for this” is already funded. Closing those gaps costs attention, not budget — and it is the only category here where that is true. What any of it costs depends on your agreement, which is why no number appears on this page.