Microsoft supply chain coverage
In developmentYou have already bought more of this than you think. Just not all of it.
Pick what is on your purchase order. We will show you which software supply chain controls it already entitles, which ones sit in a SKU you do not hold, and where Microsoft has no answer and you will need somebody else.
No prices. Enterprise Microsoft is bought on negotiated rates, list moved in July 2026, and the published figures disagree with each other — so this measures coverage, which a discount does not change.
1 · What is on the purchase order?
12 SKUs modeled. Pick every one you hold, including the add-ons — the add-ons are usually where the argument is.
GitHub Advanced Security
Microsoft Entra
Microsoft Sentinel
2 · What that covers, phase by phase
What you hold entitles 16 of 236 controls on the supply chain. Another 56 sit in Microsoft SKUs you did not select. The remaining 147 have no Microsoft answer at all — which puts Microsoft’s reachable ceiling at 72, about 31% of the field.
- You already pay for this
- Microsoft sells it, you do not hold it
- Microsoft has no answer
- Nobody we model does this
3 · Plan, control by control
Dependency Curation & Allowlisting
DEPS · level 3
Microsoft sells it, you do not hold it
In Azure DevOps Services
AI Model & Dataset Inventory
AI · level 3
Microsoft has no answer
API Specification Security Analysis
API · level 2
Microsoft has no answer
Architecture Risk Analysis
DESIGN · level 3
Microsoft has no answer
Business Context & Asset Criticality Scoring
EVM · level 3
Microsoft has no answer
Commercial Software Binary Composition Analysis
VENDOR · level 4
Microsoft has no answer
Compliance Mapping & Control Crosswalk
GRC · level 2
Microsoft has no answer
Data Flow & Trust Boundary Mapping
DESIGN · level 2
Microsoft has no answer
Nth-Party Dependency Mapping
VENDOR · level 4
Microsoft has no answer
Open Source Project Health Scoring
DEPS · level 2
Microsoft has no answer
Policy as Code Enforcement
GRC · level 3
Microsoft has no answer
Risk Register & Risk Acceptance Tracking
GRC · level 2
Microsoft has no answer
Secure Coding Training
DEVSEC · level 1
Microsoft has no answer
Secure Library & Safe Default Recommendations
DEVSEC · level 2
Microsoft has no answer
Security as Code Module Library
IAC · level 3
Microsoft has no answer
Security Exception & Waiver Management
GRC · level 2
Microsoft has no answer
Security Policy Management
GRC · level 1
Microsoft has no answer
Security Requirements Generation
DESIGN · level 2
Microsoft has no answer
Security SLA & Contract Requirement Management
VENDOR · level 2
Microsoft has no answer
Third-Party Vendor Security Assessment
VENDOR · level 1
Microsoft has no answer
Threat Modeling
DESIGN · level 2
Microsoft has no answer
Threat Modeling as Code
DESIGN · level 3
Microsoft has no answer
Vendor Attestation & SBOM Requirement Tracking
VENDOR · level 3
Microsoft has no answer
Abuse Case & Security Test Derivation
DESIGN · level 3
Nobody we model does this
No product we model provides it.
AI Usage Policy Enforcement
AI · level 2
Nobody we model does this
No product we model provides it.
Namespace & Package Name Reservation
REGISTRY · level 2
Nobody we model does this
No product we model provides it.
Security Champions Program
DR · level 2
Nobody we model does this
No product we model provides it.
Security Program Maturity Assessment
GRC · level 2
Nobody we model does this
No product we model provides it.
Tabletop Exercise Program
DR · level 3
Nobody we model does this
No product we model provides it.
The part worth acting on first. Everything marked “you already pay for this” is already funded. Closing those gaps costs attention, not budget — and it is the only category here where that is true. What any of it costs depends on your agreement, which is why no number appears on this page.