Microsoft supply chain coverage
In developmentYou have already bought more of this than you think. Just not all of it.
Pick what is on your purchase order. We will show you which software supply chain controls it already entitles, which ones sit in a SKU you do not hold, and where Microsoft has no answer and you will need somebody else.
No prices. Enterprise Microsoft is bought on negotiated rates, list moved in July 2026, and the published figures disagree with each other — so this measures coverage, which a discount does not change.
1 · What is on the purchase order?
12 SKUs modeled. Pick every one you hold, including the add-ons — the add-ons are usually where the argument is.
GitHub Advanced Security
Microsoft Entra
Microsoft Sentinel
2 · What that covers, phase by phase
What you hold entitles 41 of 236 controls on the supply chain. Another 31 sit in Microsoft SKUs you did not select. The remaining 147 have no Microsoft answer at all — which puts Microsoft’s reachable ceiling at 72, about 31% of the field.
- You already pay for this
- Microsoft sells it, you do not hold it
- Microsoft has no answer
- Nobody we model does this
3 · Operate, control by control
Agentless Workload Scanning
CLOUD · level 3
You already pay for this
Microsoft Defender for Cloud
Attack Path Analysis
CLOUD · level 4
You already pay for this
Microsoft Defender for Cloud
Attack Surface Reduction
ENDPOINT · level 2
You already pay for this
Microsoft Defender for Endpoint
CI/CD Security Posture Management
CICD · level 3
You already pay for this
Microsoft Defender for Cloud
Cloud Security Posture Management
CLOUD · level 2
You already pay for this
Microsoft Defender for Cloud
Cloud Workload Protection
K8S · level 3
You already pay for this
Microsoft Defender for Cloud
Code-to-Cloud Traceability
CLOUD · level 4
You already pay for this
Microsoft Defender for Cloud
Conditional Access
IAM · level 2
You already pay for this
Microsoft Entra ID
Data Discovery & Classification
DATA · level 2
You already pay for this
Microsoft Purview Information Protection
Data Loss Prevention
DATA · level 3
You already pay for this
Microsoft Purview Data Loss Prevention
Data Security Posture Management
CLOUD · level 4
You already pay for this
Microsoft Defender for Cloud
Device Isolation & Containment
ENDPOINT · level 3
You already pay for this
Microsoft Defender for Endpoint
Endpoint Detection & Response
ENDPOINT · level 3
You already pay for this
Microsoft Defender for Endpoint
Endpoint Vulnerability Assessment
ENDPOINT · level 2
You already pay for this
Microsoft Defender for Endpoint
Exploit Prevention
ENDPOINT · level 2
You already pay for this
Microsoft Defender for Endpoint
Identity Attack Path Validation
IAM · level 4
You already pay for this
Microsoft Defender for Identity
Identity Governance & Access Reviews
IAM · level 2
You already pay for this
Microsoft Entra ID Governance
Just-in-Time Access Elevation
IAM · level 3
You already pay for this
Microsoft Entra ID Governance
Kubernetes Security Posture Management
K8S · level 3
You already pay for this
Microsoft Defender for Cloud
Malicious Attachment & Link Detonation
EMAIL · level 2
You already pay for this
Microsoft Defender for Office 365
Multi-Factor Authentication
IAM · level 1
You already pay for this
Microsoft Entra ID
Next-Generation Antivirus
ENDPOINT · level 2
You already pay for this
Microsoft Defender for Endpoint
Phishing & Business Email Compromise Protection
EMAIL · level 1
You already pay for this
Microsoft Defender for Office 365
Real-time Threat Detection
DR · level 3
You already pay for this
Microsoft Defender XDR, Microsoft Defender for Endpoint
Sensitivity Labeling & Encryption
DATA · level 2
You already pay for this
Microsoft Purview Information Protection
Single Sign-On
IAM · level 1
You already pay for this
Microsoft Entra ID
Container Drift Prevention
K8S · level 4
Microsoft sells it, you do not hold it
In Defender for Containers (Defender for Cloud)
Container Image Vulnerability Scanning
CONTAINER · level 2
Microsoft sells it, you do not hold it
In Defender for Containers (Defender for Cloud)
Leaked Credential Validation & Revocation
SECRETS · level 3
Microsoft sells it, you do not hold it
In GitHub Secret Protection
Non-Human Identity Discovery & Governance
SECRETS · level 3
Microsoft sells it, you do not hold it
In GitHub Secret Protection, Microsoft Entra Workload ID
Repository Access Governance
SCM · level 2
Microsoft sells it, you do not hold it
In GitHub Enterprise Cloud
Runtime Threat Detection
K8S · level 3
Microsoft sells it, you do not hold it
In Defender for Containers (Defender for Cloud)
Security Log Collection & Retention
DR · level 1
Microsoft sells it, you do not hold it
In Microsoft Sentinel
Source Control Audit Logging
SCM · level 2
Microsoft sells it, you do not hold it
In GitHub Enterprise Cloud
Access Token Scoping & Least Privilege
SECRETS · level 2
Microsoft has no answer
AI Agent & MCP Server Governance
AI · level 4
Microsoft has no answer
AI Guardrails & Output Filtering
AI · level 3
Microsoft has no answer
AI Model & Dataset Inventory
AI · level 3
Microsoft has no answer
AI Sensitive Data Leakage Prevention
AI · level 3
Microsoft has no answer
API Discovery & Inventory
API · level 2
Microsoft has no answer
API Rate Limiting & Abuse Prevention
API · level 2
Microsoft has no answer
API Runtime Threat Protection
API · level 3
Microsoft has no answer
Asset Discovery & Inventory
EVM · level 1
Microsoft has no answer
Attack Surface Mapping & Validation
DESIGN · level 3
Microsoft has no answer
Automated Evidence Collection
GRC · level 3
Microsoft has no answer
Automated Penetration Testing
VALIDATE · level 3
Microsoft has no answer
Automated Secret Rotation
SECRETS · level 3
Microsoft has no answer
Breach & Attack Simulation
VALIDATE · level 4
Microsoft has no answer
Bug Bounty & Vulnerability Disclosure Program
VALIDATE · level 3
Microsoft has no answer
Centralized Secrets Management
SECRETS · level 2
Microsoft has no answer
Cloud Infrastructure Entitlement Management
CLOUD · level 3
Microsoft has no answer
Commercial Software Binary Composition Analysis
VENDOR · level 4
Microsoft has no answer
Compromised Component Blast-Radius Analysis
SBOM · level 3
Microsoft has no answer
Continuous Compliance Monitoring
GRC · level 3
Microsoft has no answer
Continuous Image Rebuild & Freshness Management
CONTAINER · level 4
Microsoft has no answer
Dynamic Short-Lived Credentials
SECRETS · level 3
Microsoft has no answer
Endpoint Rollback & Remediation
ENDPOINT · level 4
Microsoft has no answer
Exploitability Validation
VALIDATE · level 3
Microsoft has no answer
Infrastructure Drift Detection
IAC · level 3
Microsoft has no answer
Kubernetes RBAC & Service Account Least Privilege
K8S · level 3
Microsoft has no answer
Machine Identity Management
SECRETS · level 4
Microsoft has no answer
MCP Tool Poisoning Detection
AI · level 4
Microsoft has no answer
Penetration Testing
VALIDATE · level 2
Microsoft has no answer
Privileged Access Management
IAM · level 3
Microsoft has no answer
Prompt Injection Detection
AI · level 3
Microsoft has no answer
Registry Artifact Quarantine
REGISTRY · level 3
Microsoft has no answer
Registry Retention & Cleanup
REGISTRY · level 2
Microsoft has no answer
Repository Security Posture Assessment
SCM · level 2
Microsoft has no answer
Runtime Application Self-Protection
K8S · level 4
Microsoft has no answer
Runtime Component Inventory
SBOM · level 4
Microsoft has no answer
SaaS & CI/CD Integration Governance
VENDOR · level 3
Microsoft has no answer
Service Mesh mTLS Enforcement
K8S · level 4
Microsoft has no answer
Shadow & Zombie API Detection
API · level 3
Microsoft has no answer
Shadow AI Discovery
AI · level 3
Microsoft has no answer
Supply Chain Incident Response
DR · level 3
Microsoft has no answer
Vendor Attestation & SBOM Requirement Tracking
VENDOR · level 3
Microsoft has no answer
Virtual Patching
K8S · level 3
Microsoft has no answer
Web Application Firewall
K8S · level 2
Microsoft has no answer
Workload Network Micro-segmentation
K8S · level 3
Microsoft has no answer
AI Usage Policy Enforcement
AI · level 2
Nobody we model does this
No product we model provides it.
Incident Response Playbook Management
DR · level 2
Nobody we model does this
No product we model provides it.
Regulatory Incident & Vulnerability Reporting
DR · level 3
Nobody we model does this
No product we model provides it.
Tabletop Exercise Program
DR · level 3
Nobody we model does this
No product we model provides it.
The part worth acting on first. Everything marked “you already pay for this” is already funded. Closing those gaps costs attention, not budget — and it is the only category here where that is true. What any of it costs depends on your agreement, which is why no number appears on this page.