Microsoft supply chain coverage
In developmentYou have already bought more of this than you think. Just not all of it.
Pick what is on your purchase order. We will show you which software supply chain controls it already entitles, which ones sit in a SKU you do not hold, and where Microsoft has no answer and you will need somebody else.
No prices. Enterprise Microsoft is bought on negotiated rates, list moved in July 2026, and the published figures disagree with each other — so this measures coverage, which a discount does not change.
1 · What is on the purchase order?
12 SKUs modeled. Pick every one you hold, including the add-ons — the add-ons are usually where the argument is.
GitHub Advanced Security
Microsoft Entra
Microsoft Sentinel
2 · What that covers, phase by phase
What you hold entitles 19 of 236 controls on the supply chain. Another 53 sit in Microsoft SKUs you did not select. The remaining 147 have no Microsoft answer at all — which puts Microsoft’s reachable ceiling at 72, about 31% of the field.
- You already pay for this
- Microsoft sells it, you do not hold it
- Microsoft has no answer
- Nobody we model does this
3 · Code, control by control
Automated Remediation Pull Requests
DEVSEC · level 2
You already pay for this
GitHub Code Security
Contextual Remediation Guidance
EVM · level 3
You already pay for this
GitHub Code Security
Custom Security Rule Authoring
SAST · level 3
You already pay for this
GitHub Code Security
Incremental Diff Scanning
SAST · level 2
You already pay for this
GitHub Code Security
Software Composition Analysis
DEPS · level 1
You already pay for this
GitHub Code Security
Static Application Security Testing
SAST · level 2
You already pay for this
GitHub Code Security
Taint & Data-Flow Analysis
SAST · level 3
You already pay for this
GitHub Code Security
Branch Protection & Ruleset Enforcement
SCM · level 1
Microsoft sells it, you do not hold it
In Azure DevOps Services, GitHub Enterprise Cloud
Code Review Enforcement
SCM · level 2
Microsoft sells it, you do not hold it
In Azure DevOps Services, GitHub Enterprise Cloud
Commit Signing & Verification
SCM · level 3
Microsoft sells it, you do not hold it
In GitHub Enterprise Cloud
Developer & Maintainer MFA Enforcement
SCM · level 1
Microsoft sells it, you do not hold it
In GitHub Enterprise Cloud
Repository Access Governance
SCM · level 2
Microsoft sells it, you do not hold it
In GitHub Enterprise Cloud
Secret Push Protection
SECRETS · level 2
Microsoft sells it, you do not hold it
In GitHub Advanced Security for Azure DevOps, GitHub Secret Protection
Secrets Detection in Source Code
SECRETS · level 1
Microsoft sells it, you do not hold it
In GitHub Advanced Security for Azure DevOps, GitHub Secret Protection
AI Coding Assistant Security Guardrails
DEVSEC · level 3
Microsoft has no answer
AI-Generated Code Vulnerability Detection
DEVSEC · level 3
Microsoft has no answer
API Discovery & Inventory
API · level 2
Microsoft has no answer
API Specification Security Analysis
API · level 2
Microsoft has no answer
Automated Dependency Updates
DEPS · level 2
Microsoft has no answer
CI/CD Configuration Scanning
CICD · level 2
Microsoft has no answer
Developer Workstation Hardening
DEVSEC · level 3
Microsoft has no answer
Dockerfile & Image Configuration Linting
CONTAINER · level 2
Microsoft has no answer
Finding Triage & False-Positive Suppression
SAST · level 3
Microsoft has no answer
Hallucinated Package Detection
DEPS · level 3
Microsoft has no answer
IaC Automated Remediation
IAC · level 3
Microsoft has no answer
IaC Misconfiguration Scanning
IAC · level 2
Microsoft has no answer
IDE Security Linting
DEVSEC · level 1
Microsoft has no answer
Kubernetes Manifest & Helm Chart Scanning
IAC · level 2
Microsoft has no answer
Malicious Package Detection
DEPS · level 2
Microsoft has no answer
Minimum Release Age Enforcement
DEPS · level 3
Microsoft has no answer
Open Source License Compliance
DEPS · level 1
Microsoft has no answer
Open Source Project Health Scoring
DEPS · level 2
Microsoft has no answer
Pre-Commit Security Checks
DEVSEC · level 1
Microsoft has no answer
Private Fix Backporting & Upstream Contribution
DEPS · level 5
Microsoft has no answer
Secure Coding Training
DEVSEC · level 1
Microsoft has no answer
Secure Library & Safe Default Recommendations
DEVSEC · level 2
Microsoft has no answer
Security as Code Module Library
IAC · level 3
Microsoft has no answer
Security Code Review Assistance
DEVSEC · level 2
Microsoft has no answer
Threat Modeling as Code
DESIGN · level 3
Microsoft has no answer
Typosquatting Detection
DEPS · level 2
Microsoft has no answer
Unauthorized Code Change Detection
SCM · level 4
Microsoft has no answer
Workflow Injection Detection
CICD · level 2
Microsoft has no answer
Dependency Pinning & Lockfile Integrity Verification
DEPS · level 2
Nobody we model does this
No product we model provides it.
Install Script Execution Restriction
DEPS · level 3
Nobody we model does this
No product we model provides it.
Security Unit & Regression Testing
DEVSEC · level 2
Nobody we model does this
No product we model provides it.
Workflow Change Review Enforcement
CICD · level 3
Nobody we model does this
No product we model provides it.
The part worth acting on first. Everything marked “you already pay for this” is already funded. Closing those gaps costs attention, not budget — and it is the only category here where that is true. What any of it costs depends on your agreement, which is why no number appears on this page.