Microsoft supply chain coverage
In developmentYou have already bought more of this than you think. Just not all of it.
Pick what is on your purchase order. We will show you which software supply chain controls it already entitles, which ones sit in a SKU you do not hold, and where Microsoft has no answer and you will need somebody else.
No prices. Enterprise Microsoft is bought on negotiated rates, list moved in July 2026, and the published figures disagree with each other — so this measures coverage, which a discount does not change.
1 · What is on the purchase order?
12 SKUs modeled. Pick every one you hold, including the add-ons — the add-ons are usually where the argument is.
GitHub
GitHub Advanced Security
Microsoft Entra
Microsoft Sentinel
2 · What that covers, phase by phase
What you hold entitles 22 of 236 controls on the supply chain. Another 50 sit in Microsoft SKUs you did not select. The remaining 147 have no Microsoft answer at all — which puts Microsoft’s reachable ceiling at 72, about 31% of the field.
- You already pay for this
- Microsoft sells it, you do not hold it
- Microsoft has no answer
- Nobody we model does this
3 · Operate, control by control
Conditional Access
IAM · level 2
You already pay for this
Microsoft Entra ID
Data Discovery & Classification
DATA · level 2
You already pay for this
Microsoft Purview Information Protection
Multi-Factor Authentication
IAM · level 1
You already pay for this
Microsoft Entra ID
Repository Access Governance
SCM · level 2
You already pay for this
GitHub Enterprise Cloud
Sensitivity Labeling & Encryption
DATA · level 2
You already pay for this
Microsoft Purview Information Protection
Single Sign-On
IAM · level 1
You already pay for this
GitHub Enterprise Cloud, Microsoft Entra ID
Source Control Audit Logging
SCM · level 2
You already pay for this
GitHub Enterprise Cloud
Agentless Workload Scanning
CLOUD · level 3
Microsoft sells it, you do not hold it
In Defender CSPM (Defender for Cloud)
Attack Path Analysis
CLOUD · level 4
Microsoft sells it, you do not hold it
In Defender CSPM (Defender for Cloud)
Attack Surface Reduction
ENDPOINT · level 2
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
CI/CD Security Posture Management
CICD · level 3
Microsoft sells it, you do not hold it
In Defender CSPM (Defender for Cloud)
Cloud Security Posture Management
CLOUD · level 2
Microsoft sells it, you do not hold it
In Defender CSPM (Defender for Cloud)
Cloud Workload Protection
K8S · level 3
Microsoft sells it, you do not hold it
In Defender CSPM (Defender for Cloud), Defender for Containers (Defender for Cloud)
Code-to-Cloud Traceability
CLOUD · level 4
Microsoft sells it, you do not hold it
In Defender CSPM (Defender for Cloud)
Container Drift Prevention
K8S · level 4
Microsoft sells it, you do not hold it
In Defender for Containers (Defender for Cloud)
Container Image Vulnerability Scanning
CONTAINER · level 2
Microsoft sells it, you do not hold it
In Defender for Containers (Defender for Cloud)
Data Loss Prevention
DATA · level 3
Microsoft sells it, you do not hold it
In Microsoft 365 E5
Data Security Posture Management
CLOUD · level 4
Microsoft sells it, you do not hold it
In Defender CSPM (Defender for Cloud)
Device Isolation & Containment
ENDPOINT · level 3
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
Endpoint Detection & Response
ENDPOINT · level 3
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
Endpoint Vulnerability Assessment
ENDPOINT · level 2
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
Exploit Prevention
ENDPOINT · level 2
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
Identity Attack Path Validation
IAM · level 4
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
Identity Governance & Access Reviews
IAM · level 2
Microsoft sells it, you do not hold it
In Microsoft 365 E5
Just-in-Time Access Elevation
IAM · level 3
Microsoft sells it, you do not hold it
In Microsoft 365 E5
Kubernetes Security Posture Management
K8S · level 3
Microsoft sells it, you do not hold it
In Defender CSPM (Defender for Cloud), Defender for Containers (Defender for Cloud)
Leaked Credential Validation & Revocation
SECRETS · level 3
Microsoft sells it, you do not hold it
In GitHub Secret Protection
Malicious Attachment & Link Detonation
EMAIL · level 2
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
Next-Generation Antivirus
ENDPOINT · level 2
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
Non-Human Identity Discovery & Governance
SECRETS · level 3
Microsoft sells it, you do not hold it
In GitHub Secret Protection, Microsoft Entra Workload ID
Phishing & Business Email Compromise Protection
EMAIL · level 1
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
Real-time Threat Detection
DR · level 3
Microsoft sells it, you do not hold it
In Microsoft 365 E5, Microsoft 365 E5 Security add-on
Runtime Threat Detection
K8S · level 3
Microsoft sells it, you do not hold it
In Defender for Containers (Defender for Cloud)
Security Log Collection & Retention
DR · level 1
Microsoft sells it, you do not hold it
In Microsoft Sentinel
Access Token Scoping & Least Privilege
SECRETS · level 2
Microsoft has no answer
AI Agent & MCP Server Governance
AI · level 4
Microsoft has no answer
AI Guardrails & Output Filtering
AI · level 3
Microsoft has no answer
AI Model & Dataset Inventory
AI · level 3
Microsoft has no answer
AI Sensitive Data Leakage Prevention
AI · level 3
Microsoft has no answer
API Discovery & Inventory
API · level 2
Microsoft has no answer
API Rate Limiting & Abuse Prevention
API · level 2
Microsoft has no answer
API Runtime Threat Protection
API · level 3
Microsoft has no answer
Asset Discovery & Inventory
EVM · level 1
Microsoft has no answer
Attack Surface Mapping & Validation
DESIGN · level 3
Microsoft has no answer
Automated Evidence Collection
GRC · level 3
Microsoft has no answer
Automated Penetration Testing
VALIDATE · level 3
Microsoft has no answer
Automated Secret Rotation
SECRETS · level 3
Microsoft has no answer
Breach & Attack Simulation
VALIDATE · level 4
Microsoft has no answer
Bug Bounty & Vulnerability Disclosure Program
VALIDATE · level 3
Microsoft has no answer
Centralized Secrets Management
SECRETS · level 2
Microsoft has no answer
Cloud Infrastructure Entitlement Management
CLOUD · level 3
Microsoft has no answer
Commercial Software Binary Composition Analysis
VENDOR · level 4
Microsoft has no answer
Compromised Component Blast-Radius Analysis
SBOM · level 3
Microsoft has no answer
Continuous Compliance Monitoring
GRC · level 3
Microsoft has no answer
Continuous Image Rebuild & Freshness Management
CONTAINER · level 4
Microsoft has no answer
Dynamic Short-Lived Credentials
SECRETS · level 3
Microsoft has no answer
Endpoint Rollback & Remediation
ENDPOINT · level 4
Microsoft has no answer
Exploitability Validation
VALIDATE · level 3
Microsoft has no answer
Infrastructure Drift Detection
IAC · level 3
Microsoft has no answer
Kubernetes RBAC & Service Account Least Privilege
K8S · level 3
Microsoft has no answer
Machine Identity Management
SECRETS · level 4
Microsoft has no answer
MCP Tool Poisoning Detection
AI · level 4
Microsoft has no answer
Penetration Testing
VALIDATE · level 2
Microsoft has no answer
Privileged Access Management
IAM · level 3
Microsoft has no answer
Prompt Injection Detection
AI · level 3
Microsoft has no answer
Registry Artifact Quarantine
REGISTRY · level 3
Microsoft has no answer
Registry Retention & Cleanup
REGISTRY · level 2
Microsoft has no answer
Repository Security Posture Assessment
SCM · level 2
Microsoft has no answer
Runtime Application Self-Protection
K8S · level 4
Microsoft has no answer
Runtime Component Inventory
SBOM · level 4
Microsoft has no answer
SaaS & CI/CD Integration Governance
VENDOR · level 3
Microsoft has no answer
Service Mesh mTLS Enforcement
K8S · level 4
Microsoft has no answer
Shadow & Zombie API Detection
API · level 3
Microsoft has no answer
Shadow AI Discovery
AI · level 3
Microsoft has no answer
Supply Chain Incident Response
DR · level 3
Microsoft has no answer
Vendor Attestation & SBOM Requirement Tracking
VENDOR · level 3
Microsoft has no answer
Virtual Patching
K8S · level 3
Microsoft has no answer
Web Application Firewall
K8S · level 2
Microsoft has no answer
Workload Network Micro-segmentation
K8S · level 3
Microsoft has no answer
AI Usage Policy Enforcement
AI · level 2
Nobody we model does this
No product we model provides it.
Incident Response Playbook Management
DR · level 2
Nobody we model does this
No product we model provides it.
Regulatory Incident & Vulnerability Reporting
DR · level 3
Nobody we model does this
No product we model provides it.
Tabletop Exercise Program
DR · level 3
Nobody we model does this
No product we model provides it.
The part worth acting on first. Everything marked “you already pay for this” is already funded. Closing those gaps costs attention, not budget — and it is the only category here where that is true. What any of it costs depends on your agreement, which is why no number appears on this page.