Microsoft supply chain coverage
In developmentYou have already bought more of this than you think. Just not all of it.
Pick what is on your purchase order. We will show you which software supply chain controls it already entitles, which ones sit in a SKU you do not hold, and where Microsoft has no answer and you will need somebody else.
No prices. Enterprise Microsoft is bought on negotiated rates, list moved in July 2026, and the published figures disagree with each other — so this measures coverage, which a discount does not change.
1 · What is on the purchase order?
12 SKUs modeled. Pick every one you hold, including the add-ons — the add-ons are usually where the argument is.
GitHub Advanced Security
Microsoft Entra
Microsoft Sentinel
2 · What that covers, phase by phase
What you hold entitles 17 of 236 controls on the supply chain. Another 55 sit in Microsoft SKUs you did not select. The remaining 147 have no Microsoft answer at all — which puts Microsoft’s reachable ceiling at 72, about 31% of the field.
- You already pay for this
- Microsoft sells it, you do not hold it
- Microsoft has no answer
- Nobody we model does this
3 · Monitor, control by control
Automated Ticketing & Remediation Workflow
EVM · level 2
You already pay for this
GitHub Code Security
Contextual Remediation Guidance
EVM · level 3
You already pay for this
GitHub Code Security
Non-Human Identity Discovery & Governance
SECRETS · level 3
You already pay for this
Microsoft Entra Workload ID
Software Composition Analysis
DEPS · level 1
You already pay for this
GitHub Code Security
Vulnerability SLA Tracking
EVM · level 2
You already pay for this
GitHub Code Security
Automated Investigation & Response
DR · level 4
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
CI/CD Security Posture Management
CICD · level 3
Microsoft sells it, you do not hold it
In Defender CSPM (Defender for Cloud)
Cloud Security Posture Management
CLOUD · level 2
Microsoft sells it, you do not hold it
In Defender CSPM (Defender for Cloud)
Engineering Platform Audit Log Monitoring
DR · level 3
Microsoft sells it, you do not hold it
In Azure DevOps Services, Microsoft Sentinel
Extended Detection & Response Correlation
DR · level 3
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
Identity Threat Detection & Response
IAM · level 3
Microsoft sells it, you do not hold it
In Microsoft 365 E3, Microsoft 365 E5, Microsoft 365 E5 Security add-on
Leaked Credential Validation & Revocation
SECRETS · level 3
Microsoft sells it, you do not hold it
In GitHub Secret Protection
Real-time Threat Detection
DR · level 3
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
Security Information & Event Management
DR · level 2
Microsoft sells it, you do not hold it
In Microsoft Sentinel
Security Orchestration & Automated Response
DR · level 3
Microsoft sells it, you do not hold it
In Microsoft Sentinel
Source Control Audit Logging
SCM · level 2
Microsoft sells it, you do not hold it
In GitHub Enterprise Cloud
Threat Hunting
DR · level 4
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on, Microsoft Sentinel
Threat Intelligence Integration
DR · level 3
Microsoft sells it, you do not hold it
In Microsoft Sentinel
User & Entity Behavior Analytics
DR · level 4
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on, Microsoft Sentinel
Application Security Posture Management
EVM · level 3
Microsoft has no answer
Attack Surface Mapping & Validation
DESIGN · level 3
Microsoft has no answer
Compromised Component Blast-Radius Analysis
SBOM · level 3
Microsoft has no answer
Continuous Compliance Monitoring
GRC · level 3
Microsoft has no answer
Continuous SBOM Vulnerability Monitoring
SBOM · level 3
Microsoft has no answer
Continuous Vendor Risk Monitoring
VENDOR · level 3
Microsoft has no answer
Cross-Tool Finding Correlation
EVM · level 4
Microsoft has no answer
Detection Engineering as Code
DR · level 4
Microsoft has no answer
End-of-Life Component Detection
DEPS · level 2
Microsoft has no answer
Finding Ownership Routing
EVM · level 3
Microsoft has no answer
Finding Triage & False-Positive Suppression
SAST · level 3
Microsoft has no answer
Fix Validation
EVM · level 3
Microsoft has no answer
Infrastructure Drift Detection
IAC · level 3
Microsoft has no answer
Maintainer & Publisher Risk Analysis
DEPS · level 3
Microsoft has no answer
Managed Detection & Response
DR · level 3
Microsoft has no answer
Risk Register & Risk Acceptance Tracking
GRC · level 2
Microsoft has no answer
Risk-Based Vulnerability Prioritization
EVM · level 3
Microsoft has no answer
SBOM Ingestion & Management
SBOM · level 3
Microsoft has no answer
Security Metrics & ROI Reporting
GRC · level 3
Microsoft has no answer
Software Supply Chain Graph Analysis
SBOM · level 4
Microsoft has no answer
VEX Authoring & Consumption
SBOM · level 4
Microsoft has no answer
Vulnerability Aggregation & Deduplication
EVM · level 2
Microsoft has no answer
Vulnerability Root Cause Analysis
EVM · level 4
Nobody we model does this
No product we model provides it.
The part worth acting on first. Everything marked “you already pay for this” is already funded. Closing those gaps costs attention, not budget — and it is the only category here where that is true. What any of it costs depends on your agreement, which is why no number appears on this page.