Open Source Compliance & Microsoft Licensing: Enterprise Guide

Open source compliance doesn't change your Microsoft licence count — but it drives significant Microsoft licensing spend. Every enterprise that takes open source security seriously ends up purchasing GitHub Advanced Security (GHAS) for dependency scanning and secret detection. At $49/active committer/month, a 500-developer team spending $294,000/year on GHAS alone makes OSS compliance one of the largest line items in developer toolchain budgets. Understanding how open source obligations interact with Microsoft's tooling and EA structure is essential to controlling these costs.

The Intersection of Open Source and Microsoft Licensing

There are four primary points where open source compliance obligations generate Microsoft licensing costs:

The key observation is that GHAS is not required for basic OSS dependency scanning — Dependabot alerts are available free with GitHub Enterprise Cloud, without GHAS. GHAS adds CodeQL code scanning (finds security vulnerabilities within your proprietary code), advanced secret scanning (enterprise partners, custom patterns), and dependency review in PR checks. Many enterprises pay for GHAS when they actually only need Dependabot, overspending by $49/user/month unnecessarily.

GitHub Advanced Security Licensing Deep-Dive

GHAS is the primary Microsoft/GitHub tool for open source security, and its licensing model is frequently misunderstood. The GitHub Advanced Security licensing guide covers the full model, but the key points for OSS compliance decisions are:

The Active Committer Definition

GHAS is billed per "active committer" — a unique GitHub user who has committed to at least one private GHAS-enabled repository in the past 90 days. This definition creates several cost management opportunities:

• Contractor and vendor accounts: External contributors who commit to private repos count as billable committers. A project with 10 external contractors each making one commit/month adds $490/month in GHAS costs for those 10 accounts — often not budgeted.
• Bot accounts: Automated commit accounts (CI bots, release bots, dependency update bots like Dependabot itself) do not count as GHAS committers. Verify your bot accounts are properly classified.
• Selective enablement: You can enable GHAS per-repository. Only repositories with GHAS enabled contribute to committer count. Separate critical repositories (production services, customer-data adjacent) that genuinely need GHAS from internal tooling repositories where Dependabot alerts (free) suffice.
• Shared accounts: If multiple developers share a single GitHub account (a violation of GitHub's ToS, but common in legacy setups), they count as 1 committer. Normalising to individual accounts before GHAS purchase can increase committer count and cost — audit this before signing GHAS agreements.

GHAS Pricing and EA Negotiation

At 500 committers on a 3-year EA with 30% discount, GHAS costs $17,150/month ($205,800/year) vs $294,000/year at list price. The savings from EA negotiation justify specialist negotiation support for any organisation with 200+ GHAS committers.

SBOM Requirements and Microsoft's Position

The Software Bill of Materials (SBOM) has moved from best practice to regulatory requirement. US Executive Order 14028 (May 2021) mandated SBOM requirements for software sold to federal agencies. The EU Cyber Resilience Act (2024–2027 implementation) extends similar requirements to commercial software sold in Europe. Both frameworks require machine-readable SBOMs in SPDX or CycloneDX formats.

Microsoft SBOM Tooling

GitHub provides two SBOM capabilities:

GitHub Dependency Graph + SBOM export: Available free with all GitHub plans including GitHub Enterprise Cloud. The Dependency Graph automatically detects dependencies in supported package manifests (npm, Maven, Gradle, pip, NuGet, RubyGems, Cargo, Go Modules, etc.) and generates SPDX-format SBOMs via the GitHub API or the GitHub UI (Insights → Dependency Graph → Export SBOM). This covers the majority of SBOM generation requirements for GitHub-hosted code at no additional cost.

GitHub Advanced Security Dependency Review: Part of GHAS, this adds dependency review in pull requests — blocking PRs that introduce new vulnerable or licence-restricted dependencies. It does not generate SBOMs directly but enforces dependency policy at the point of change. GHAS is not required solely for SBOM compliance.

Microsoft SBOM Tool (open source): Microsoft publishes the "SBOM Tool" as an open source project (github.com/microsoft/sbom-tool). It generates SBOMs for packages and components independent of GitHub, supporting scenarios where code is not hosted on GitHub (Azure DevOps, on-premises repositories). No licence cost.

Azure DevOps SBOM Support

Azure DevOps does not have native SBOM generation equivalent to GitHub Dependency Graph. For Azure DevOps-based development pipelines, SBOM generation requires either the Microsoft SBOM Tool (free, OSS) integrated as a pipeline task, or third-party tools like Anchore, Aqua, or Black Duck integrated via Azure DevOps Marketplace extensions (costs vary by vendor).

Open Source Licence Compliance and Enterprise Risk

Open source licence compliance is a legal risk, not a Microsoft licensing risk — but it drives Microsoft tooling spend. The categories of concern for enterprises:

Copyleft Licence Categories

Microsoft's own products increasingly include components under permissive licences. .NET 6+ is MIT-licenced. VS Code is MIT-licenced. Azure SDK libraries are MIT or Apache 2.0. This does not create compliance obligations for EA customers — Microsoft's EULA governs commercial use of Microsoft products regardless of component licences — but it matters for customers forking or modifying Microsoft OSS.

The Microsoft IP Indemnification Question

Standard Microsoft EA includes IP indemnification for Microsoft-produced software. GitHub Copilot's IP indemnification (introduced mid-2023) covers code suggestions that match training data in the Copilot Business and Enterprise tiers. However, Microsoft's IP indemnification does not extend to open source components that Copilot suggests from its training corpus — the legal risk for GPL-contaminated Copilot suggestions remains with the customer.

Practically, this means enterprises using GitHub Copilot should enable the "public code filter" (which blocks Copilot suggestions that exactly match public code, including open source) and maintain code review processes specifically checking for OSS licence contamination in AI-suggested code. See our GitHub Copilot Enterprise licensing guide for the full IP indemnification framework.

Competitive Alternatives to GHAS for OSS Compliance

GHAS is not the only enterprise option for open source security and compliance. The competitive landscape matters for EA negotiations — documenting viable alternatives gives you negotiation leverage:

The existence of Dependabot (free) and mature OSS tools like Trivy, Grype, and OWASP Dependency-Check means GHAS is not required for basic dependency vulnerability management. GHAS is genuinely differentiated for CodeQL-based semantic code analysis finding logic vulnerabilities within proprietary code. If your OSS compliance need is primarily dependency scanning and SBOM generation, evaluate whether free tools plus Dependabot meet your requirements before committing to GHAS at $49/committer/month.

EA Negotiation: Developer Toolchain as a Package

The most effective negotiation strategy for OSS compliance tooling is to bundle it with the broader developer toolchain renewal. Microsoft and GitHub view the developer toolchain as: GitHub Enterprise Cloud + GHAS + GitHub Copilot + Azure DevOps. Each component has list pricing with room for EA negotiation, but the biggest discounts come from committing to the full stack.

The negotiation framework for a 500-developer organisation:

• Anchor the conversation on total spend: GitHub Enterprise Cloud ($21/user/month) + GHAS ($49/committer/month) + Copilot Business ($19/user/month) = $89/developer/month or $534,000/year at list. This is a significant number that gives you legitimate grounds to request 20–30% package discount.
• Selective GHAS enablement as a negotiation counter: Offer to enable GHAS on all repositories (vs selective enablement) in exchange for a volume discount. Microsoft's goal is universal GHAS adoption — use this as leverage.
• Phased Copilot deployment commitment: Commit to Copilot on 50% of GHAS-licenced committers in year 1, 80% in year 2, in exchange for a 3-year GHAS rate lock.
• Competitive alternative documentation: Snyk at $25–35/developer/month is meaningfully cheaper than GHAS at $49/committer/month for comparable SCA functionality. Document this as a genuine alternative path — Microsoft will respond with pricing flexibility to retain the account.

For the complete EA negotiation framework for developer tooling, see our developer licensing EA optimisation guide and the Microsoft Developer & DevOps EA licensing complete guide.

Frequently Asked Questions

Does using open source software affect my Microsoft EA licensing?

Indirectly. Open source usage doesn't change your Microsoft licence count, but open source compliance obligations (SBOM, dependency scanning, vulnerability tracking) drive the need for tools like GitHub Advanced Security, which carries EA licensing costs. GHAS charges per active committer — typically $49/user/month — making OSS compliance tooling one of the largest hidden costs in developer licensing.

What is GitHub Advanced Security and how is it licensed?

GitHub Advanced Security (GHAS) provides code scanning (CodeQL), secret scanning, and dependency review. It is licensed per "active committer" — a unique committer who has made at least 1 commit to a GHAS-enabled private repository in the last 90 days. List price is $49/active committer/month. EA discounts of 20–30% are common at 100+ committer scale.

What is Microsoft's position on GPL-licenced components?

Microsoft has no specific EA provision covering GPL contamination risk in customer code. GPL licence obligations are a legal matter between the customer and the GPL licence terms — not a Microsoft licensing issue. However, GHAS dependency scanning can identify GPL components in your codebase, and legal counsel should assess distribution implications.

Are SBOM requirements affecting Microsoft product purchases?

Yes. US Executive Order 14028 and EU Cyber Resilience Act require SBOMs for software sold to government and increasingly commercial markets. This drives demand for GitHub Advanced Security and GitHub Dependency Graph capabilities, both of which have EA licence cost implications.

Can Microsoft's own products contain open source components?

Yes. Azure services, .NET, VS Code, and many Microsoft products incorporate open source libraries. Microsoft's EULA governs commercial use of Microsoft products regardless of component licences, so this does not create compliance obligations for EA customers — but it matters for security due diligence and customers modifying Microsoft OSS.