Capability reference¶
31 capabilities. Each discloses its workloads, entitlement kind, backends, clouds, SKU part numbers, service plans, the checks it gates, and its catalog source version.
| Capability | Workloads | Kind | Backends | Clouds | SKUs | Service plans | Required by | Source version |
|---|---|---|---|---|---|---|---|---|
conditional_access |
identity | included |
graph | commercial, dod, gcc, gcc_high | AAD_PREMIUM, AAD_PREMIUM_P2, ENTERPRISEPREMIUM, SPE_E3, SPE_E5 | AAD_PREMIUM, AAD_PREMIUM_P2 | id-app-admin-consent-workflow, id-app-certificate-lifetime, id-app-expiring-credentials, id-app-ownerless-or-stale, id-app-password-addition-blocked, id-app-password-lifetime, id-app-registration-admin-only, id-app-risky-delegated-consent, id-app-user-consent-restricted, id-auth-authenticator-context, id-auth-methods-migration, id-auth-weak-methods-disabled, id-break-glass-exclusion, id-ca-device-code-block, id-ca-legacy-auth-block, id-ca-managed-devices, id-ca-mfa-all-users, id-ca-mfa-registration-managed, id-ca-phishing-resistant-all, id-ca-phishing-resistant-privileged, id-ca-priv-gaps, id-cross-tenant-defaults, id-cross-tenant-mfa-trust, id-guest-directory-access-limited, id-guest-invite-domains, id-guest-inviter-restricted, id-logs-to-soc, id-number-matching, id-password-never-expire, id-security-defaults-on | 2026-08 |
defender_endpoint_p1 |
defender, endpoint | add_on |
graph, mde | commercial, dod, gcc, gcc_high | DEFENDER_ENDPOINT_P1, IDENTITY_THREAT_PROTECTION, MDE_P1, SPE_E3 | DEFENDER_ENDPOINT_P1, MDE_LITE, MDE_P1 | ep-asr-rules, ep-tamper-protection, mde-onboard-gap, mde-sensor-health | 2026-08 |
defender_endpoint_p2 |
defender, endpoint | included |
graph, mde | commercial, dod, gcc, gcc_high | DEFENDER_ENDPOINT_P2, IDENTITY_THREAT_PROTECTION, SPE_E5 | DEFENDER_ENDPOINT_P2, MDATP_XPLAT | ep-asr-rules, ep-tamper-protection, id-protective-plan-assignment, mde-onboard-gap, mde-sensor-health | 2026-08 |
defender_for_cloud_cspm |
azure, defender | consumption |
arm | commercial, dod, gcc, gcc_high | — | — | az-cspm-out-of-scope, az-defender-plan-enabled | 2026-08 |
defender_for_cloud_servers |
azure, defender | consumption |
arm | commercial, dod, gcc, gcc_high | — | — | az-defender-plan-enabled | 2026-08 |
defender_identity |
defender, identity | included |
graph, manual | commercial, gcc, gcc_high | EMSPREMIUM, ENTERPRISEPREMIUM, SPE_E5 | ATA, MDI_Service_Plan | mdi-sensors-missing | 2026-08 |
defender_office_p1 |
defender, exchange | add_on |
exchange_powershell, graph, security_compliance_powershell | commercial, dod, gcc, gcc_high | ATP_ENTERPRISE, ENTERPRISEPREMIUM, IDENTITY_THREAT_PROTECTION, SPE_E5 | ATP_ENTERPRISE | mdo-alert-policies-enabled, mdo-malware-file-filter, mdo-malware-zap | 2026-08 |
defender_office_p2 |
defender, exchange | included |
exchange_powershell, graph, security_compliance_powershell | commercial, dod, gcc, gcc_high | ENTERPRISEPREMIUM, IDENTITY_THREAT_PROTECTION, SPE_E5 | ATP_ENTERPRISE, THREAT_INTELLIGENCE | id-protective-plan-assignment, mdo-impersonation-domains-owned, mdo-impersonation-partner-domains, mdo-impersonation-users-protected, mdo-mailbox-intelligence, mdo-p2-policies-default, mdo-safe-attachments-block, mdo-safe-attachments-spo-teams, mdo-safe-documents, mdo-safe-links-block-list, mdo-safe-links-click-through, mdo-safe-links-click-tracking, mdo-safe-links-real-time-scan, mdo-safety-tips-enabled | 2026-08 |
defender_xdr |
defender | included |
graph, mde | commercial, gcc, gcc_high | EMSPREMIUM, IDENTITY_THREAT_PROTECTION, SPE_E5 | ATA, DEFENDER_ENDPOINT_P2, MDI_Service_Plan, THREAT_INTELLIGENCE | xdr-incident-readiness | 2026-08 |
entitlement_management |
identity | add_on |
graph | commercial | Microsoft_Entra_ID_Governance | Entra_Identity_Governance | id-entitlement-access-packages | 2026-08 |
entra_id_p2 |
identity | included |
graph | commercial, dod, gcc, gcc_high | AAD_PREMIUM_P2, EMSPREMIUM, ENTERPRISEPREMIUM, SPE_E5 | AAD_PREMIUM_P2 | id-access-reviews-scope, id-access-reviews-unused, id-break-glass-exclusion, id-dormant-privileged, id-ga-count-bounds, id-ga-finer-roles, id-pim-activation-controls, id-pim-ga-activation-alert, id-pim-ga-activation-approval, id-pim-no-outside-pam, id-pim-no-permanent-privileged, id-pim-other-activation-alert, id-pim-privileged-assignment-alert, id-pim-unused, id-priv-cloud-only, id-protective-plan-assignment | 2026-08 |
exchange_online |
exchange | base |
exchange_powershell, graph | commercial, dod, gcc, gcc_high | ENTERPRISEPACK, ENTERPRISEPREMIUM, EXCHANGEENTERPRISE, EXCHANGESTANDARD, SPE_E3, SPE_E5 | EXCHANGESTANDARD, EXCHANGE_S_ENTERPRISE, EXCHANGE_S_STANDARD | exo-dkim-enabled, exo-dmarc-agency-contact, exo-dmarc-federal-contact, exo-dmarc-published, exo-dmarc-reject, exo-external-sender-warnings, exo-forwarding-external-disabled, exo-mailbox-audit-enabled, exo-sharing-calendar-not-all-domains, exo-sharing-contact-not-all-domains, exo-smtp-auth-disabled, exo-spf-published | 2026-08 |
exchange_online_protection |
defender, exchange | included |
exchange_powershell, security_compliance_powershell | commercial, dod, gcc, gcc_high | ENTERPRISEPACK, ENTERPRISEPREMIUM, EXCHANGEENTERPRISE, EXCHANGESTANDARD, SPE_E3, SPE_E5 | EOP_ENTERPRISE, EXCHANGE_S_FOUNDATION | mdo-anti-spam-no-allowed-domains, mdo-connection-filter-no-ip-allow, mdo-connection-filter-no-safe-list, mdo-outbound-spam-forwarding-block, mdo-quarantine-policy, mdo-spam-phish-not-inbox, mdo-transport-rule-external-forward | 2026-08 |
identity_protection |
identity | included |
graph | commercial, dod, gcc, gcc_high | AAD_PREMIUM_P2, ENTERPRISEPREMIUM, SPE_E5 | AAD_PREMIUM_P2 | id-ai-agents-risky-block, id-ca-high-risk-signins, id-ca-high-risk-users, id-idprotect-notify-high-risk, id-idprotect-off, id-protective-plan-assignment | 2026-08 |
intune |
endpoint, intune | included |
graph | commercial, dod, gcc, gcc_high | EMSPREMIUM, ENTERPRISEPACK, ENTERPRISEPREMIUM, INTUNE_A, SPE_E3, SPE_E5 | INTUNE_A, INTUNE_A_VL, MDM_SALES_COLLABORATION | endpoint-compliance-noncompliance-action, endpoint-compliance-policy-assigned, endpoint-enrollment-coverage, endpoint-mde-connector, endpoint-security-baseline, endpoint-security-policy-coverage, ep-bitlocker-policy, ep-compliance-enforcement, ep-mam-app-protection, id-ca-managed-devices, id-ca-mfa-registration-managed | 2026-08 |
log_analytics |
azure, sentinel | consumption |
arm | commercial, dod, gcc, gcc_high | — | — | sen-log-analytics-retention | 2026-08 |
microsoft_sentinel |
sentinel | consumption |
arm, graph | commercial, dod, gcc, gcc_high | — | — | sen-analytics-rule-coverage, sen-automation-rules, sen-data-connectors, sen-entra-diagnostics-routed, sen-log-analytics-retention, sen-rule-telemetry-parity, sen-telemetry-ingestion-coverage, sen-ueba-not-enabled | 2026-08 |
onedrive_for_business |
collaboration | included |
graph, sharepoint_powershell | commercial, dod, gcc, gcc_high | ENTERPRISEPACK, ENTERPRISEPREMIUM, SPE_E3, SPE_E5 | ONEDRIVESTANDARD, SHAREPOINTENTERPRISE, SHAREPOINTWAC | spo-onedrive-sharing-limited | 2026-08 |
power_bi_premium |
power_bi | add_on |
graph, power_bi | commercial, gcc, gcc_high | PBI_PREMIUM_PER_USER, POWER_BI_PREMIUM_PER_USER | BI_AZURE_P3, POWER_BI_PREMIUM_PER_USER | pbi-premium-capacity-governance | 2026-08 |
power_bi_pro |
power_bi | base |
graph, power_bi | commercial, dod, gcc, gcc_high | ENTERPRISEPREMIUM, POWER_BI_PRO, POWER_BI_STANDARD, SPE_E5 | BI_AZURE_P2, POWER_BI_PRO, POWER_BI_STANDARD | pbi-export-controls, pbi-external-invite-disabled, pbi-guest-access-disabled, pbi-publish-to-web-disabled, pbi-python-r-visuals-disabled, pbi-resource-key-auth-blocked, pbi-sensitivity-labels-enabled, pbi-sp-api-restricted, pbi-sp-profiles-disabled | 2026-08 |
power_platform |
power_platform | included |
graph, power_platform | commercial, gcc, gcc_high | ENTERPRISEPACK, ENTERPRISEPREMIUM, FLOW_PER_USER, POWERAPPS_PER_USER, SPE_E3, SPE_E5 | FLOW_O365_P2, FLOW_O365_P3, POWERAPPS_O365_P2, POWERAPPS_O365_P3 | pp-dlp-all-environments, pp-dlp-nondefault-envs, pp-env-creation-admin-only, pp-pages-creation-admin-only, pp-share-with-everyone-disabled, pp-tenant-isolation-allowlist, pp-tenant-isolation-enabled, pp-trial-creation-admin-only | 2026-08 |
purview_audit |
purview | included |
graph, security_compliance_powershell | commercial, dod, gcc, gcc_high | ENTERPRISEPREMIUM, INFORMATION_PROTECTION_COMPLIANCE, SPE_E5 | EQUIVIO_ANALYTICS, M365_ADVANCED_AUDITING | mdo-audit-retention, mdo-unified-audit-enabled | 2026-08 |
purview_communication_compliance |
purview | add_on |
graph, security_compliance_powershell | commercial, gcc, gcc_high | ENTERPRISEPREMIUM, INFORMATION_PROTECTION_COMPLIANCE, SPE_E5 | COMMUNICATION_COMPLIANCE, COMM_COMPLIANCE | pur-communication-compliance-readiness | 2026-08 |
purview_dlp |
purview | included |
graph, security_compliance_powershell | commercial, dod, gcc, gcc_high | ENTERPRISEPREMIUM, INFORMATION_PROTECTION_COMPLIANCE, SPE_E5 | INFORMATION_BARRIERS, MIP_S_CLP2 | id-protective-plan-assignment, pur-dlp-enforcement-block, pur-dlp-locations-complete, pur-dlp-not-enforced, pur-dlp-notifications, pur-dlp-policy-present, pur-endpoint-dlp | 2026-08 |
purview_ediscovery |
purview | included |
graph, security_compliance_powershell | commercial, dod, gcc, gcc_high | ENTERPRISEPREMIUM, INFORMATION_PROTECTION_COMPLIANCE, SPE_E5 | EQUIVIO_ANALYTICS, EXCHANGE_ANALYTICS, LOCKBOX_ENTERPRISE | pur-ediscovery-readiness | 2026-08 |
purview_insider_risk |
purview | add_on |
graph, security_compliance_powershell | commercial, gcc, gcc_high | ENTERPRISEPREMIUM, INFORMATION_PROTECTION_COMPLIANCE, INSIDER_RISK_MANAGEMENT, SPE_E5 | INSIDER_RISK_MANAGEMENT, MIR_SERVICE | pur-insider-risk-readiness | 2026-08 |
purview_retention |
purview | included |
graph, security_compliance_powershell | commercial, dod, gcc, gcc_high | ENTERPRISEPACK, ENTERPRISEPREMIUM, INFORMATION_PROTECTION_COMPLIANCE, SPE_E3, SPE_E5 | Data_Lifecycle_Management, Records_Management | pur-retention-policy-coverage | 2026-08 |
purview_sensitivity_labels |
purview | included |
graph, security_compliance_powershell | commercial, dod, gcc, gcc_high | ENTERPRISEPACK, ENTERPRISEPREMIUM, INFORMATION_PROTECTION_COMPLIANCE, SPE_E3, SPE_E5 | INFORMATION_PROTECTION_COMPLIANCE, MIP_S_CLP1, MIP_S_CLP2 | pur-default-and-mandatory-labels, pur-sensitivity-auto-labeling, pur-sensitivity-labels-published | 2026-08 |
sharepoint_online |
collaboration | base |
graph, sharepoint_powershell | commercial, dod, gcc, gcc_high | ENTERPRISEPACK, ENTERPRISEPREMIUM, SHAREPOINTENTERPRISE, SHAREPOINTSTANDARD, SPE_E3, SPE_E5 | SHAREPOINTENTERPRISE, SHAREPOINTSTANDARD, SHAREPOINTWAC | spo-anyone-link-expiration, spo-anyone-link-view, spo-default-link-specific, spo-default-link-view, spo-domain-restrictions, spo-sharing-capability-limited, spo-unmanaged-device-access, spo-verification-reauth | 2026-08 |
teams |
collaboration, teams | base |
graph, teams_powershell | commercial, dod, gcc, gcc_high | ENTERPRISEPACK, ENTERPRISEPREMIUM, SPE_E3, SPE_E5, TEAMS_EXPLORATORY | MCOSTANDARD, TEAMS1, TEAMS_COMMERCIAL_TRIAL | teams-anonymous-lobby, teams-anonymous-start-disabled, teams-broadcast-not-always-record, teams-custom-apps-governed, teams-dialin-lobby, teams-email-integration-disabled, teams-external-access-per-domain, teams-external-control-disabled, teams-guest-access-restricted, teams-internal-auto-admit, teams-microsoft-apps-governed, teams-recording-disabled, teams-third-party-apps-governed, teams-unmanaged-inbound-blocked, teams-unmanaged-outbound-blocked | 2026-08 |
workload_identities_premium |
identity | add_on |
graph | commercial | Workload_Identities_P2, Workload_Identities_Premium_CN | AAD_WRKLDID_P2 | id-ca-workload-identity, id-identity-protection-workload | 2026-08 |
docs_url values are disclosed in reference.json (docs_url field per
capability) to keep this table readable.