Microsoft supply chain coverage
In developmentYou have already bought more of this than you think. Just not all of it.
Pick what is on your purchase order. We will show you which software supply chain controls it already entitles, which ones sit in a SKU you do not hold, and where Microsoft has no answer and you will need somebody else.
No prices. Enterprise Microsoft is bought on negotiated rates, list moved in July 2026, and the published figures disagree with each other — so this measures coverage, which a discount does not change.
1 · What is on the purchase order?
12 SKUs modeled. Pick every one you hold, including the add-ons — the add-ons are usually where the argument is.
GitHub Advanced Security
Microsoft Entra
Microsoft Sentinel
2 · What that covers, phase by phase
What you hold entitles 19 of 236 controls on the supply chain. Another 53 sit in Microsoft SKUs you did not select. The remaining 147 have no Microsoft answer at all — which puts Microsoft’s reachable ceiling at 72, about 31% of the field.
- You already pay for this
- Microsoft sells it, you do not hold it
- Microsoft has no answer
- Nobody we model does this
3 · Deploy, control by control
Deployment Environment Protection
CICD · level 3
Microsoft sells it, you do not hold it
In Azure DevOps Services, GitHub Enterprise Cloud
Workload Identity Federation
SECRETS · level 3
Microsoft sells it, you do not hold it
In Azure DevOps Services, GitHub Enterprise Cloud, Microsoft 365 E3, Microsoft 365 E5, Microsoft 365 E5 Security add-on, Microsoft Entra Workload ID
AI Agent & MCP Server Governance
AI · level 4
Microsoft has no answer
API Rate Limiting & Abuse Prevention
API · level 2
Microsoft has no answer
Artifact Chain-of-Custody Tracing
BUILD · level 4
Microsoft has no answer
Artifact Promotion Control
REGISTRY · level 3
Microsoft has no answer
Attestation Policy Evaluation
BUILD · level 4
Microsoft has no answer
Centralized Secrets Management
SECRETS · level 2
Microsoft has no answer
Dynamic Short-Lived Credentials
SECRETS · level 3
Microsoft has no answer
IaC Plan-Time Policy Evaluation
IAC · level 3
Microsoft has no answer
Image Digest Pinning Enforcement
CONTAINER · level 2
Microsoft has no answer
Kubernetes Admission Control
K8S · level 3
Microsoft has no answer
Kubernetes RBAC & Service Account Least Privilege
K8S · level 3
Microsoft has no answer
Machine Identity Management
SECRETS · level 4
Microsoft has no answer
Policy as Code Enforcement
GRC · level 3
Microsoft has no answer
Service Mesh mTLS Enforcement
K8S · level 4
Microsoft has no answer
Signature & Provenance Admission Enforcement
REGISTRY · level 4
Microsoft has no answer
Signature Verification
BUILD · level 3
Microsoft has no answer
Workload Network Micro-segmentation
K8S · level 3
Microsoft has no answer
Workload Runtime Hardening
K8S · level 3
Microsoft has no answer
Artifact Digest Integrity Verification
BUILD · level 2
Nobody we model does this
No product we model provides it.
The part worth acting on first. Everything marked “you already pay for this” is already funded. Closing those gaps costs attention, not budget — and it is the only category here where that is true. What any of it costs depends on your agreement, which is why no number appears on this page.