Azure DevOps
How to read this report
Estimated means potential usage returned by the Azure preview API, not proof that a product is enabled. Unknown does not mean free. Costs are monthly USD list-price scenarios, not a quote. Do not add subtotals to their component rows.
Executive summary
Azure DevOpsCollection at a glance (5 rows)
| Provider | Dataset | Collected | Interpretation |
|---|---|---|---|
| Azure DevOps | Source coverage | 0 included; 0 skipped | Included means some data was accessible, not that every dataset succeeded. |
| Azure DevOps | Repository inventory | 0 | 0 with complete default-branch activity. Visible scope only. |
| Azure DevOps | Provider billing datasets | Not recorded | Each product/period has separate status; unavailable is not zero. See coverage details. |
| Azure DevOps | Daily usage detail | 0 | Raw usage rows, not seats. Summarized separately below; do not add to monthly aggregates. |
| Azure DevOps | Enablement estimates | Legacy identity-only estimate | Potential usage if enabled, not current charges. Two product rows can describe the same person. |
Provider-reported billing and enablement evidence
Billing snapshots, enablement estimates and usage charges are separate datasets. Do not add overlapping scopes or summaries to detail.
Reported billing usage (0 rows)
No rows collected. Check collection coverage; this does not establish zero usage.
Usage and security evidence
Settings are current snapshots, not proof of recent scanning or payment. Reported billing usage is not an invoice; missing rows do not mean zero cost. Activity uses committer dates, including automation. Date windows are UTC; the final day may be incomplete.
Repository inventory (0 rows)
No rows collected. Check collection coverage; this does not establish zero usage.
Security settings (0 rows)
No rows collected. Check collection coverage; this does not establish zero usage.
Daily activity (0 rows)
No rows collected. Check collection coverage; this does not establish zero usage.
Collection evidence (0 rows)
No rows collected. Check collection coverage; this does not establish zero usage.
Source status
| Provider | Source | Status | Returned identity rows | Reason | How to fix | Scope |
|---|
Estimated billing
Public price assumptionsSolution pricing totals
Totals cover the full collected scope, not screen filters. Counts are product-specific estimates, not confirmed licensed seats. GHAS subtotals combine Code Security and Secret Protection costs; do not add subtotals to their component rows. Annualized estimates are monthly estimates x 12, not annual contract quotes. Other plans without usage evidence remain unpriced.
Pricing totals unavailable. No complete cost estimates were collected; this is not zero cost.
Evidence-based recommendations
CIO decision brief
Local rule-based analysis, not AI-generated advice. Based on the full collected provider scope, not screen filters. Priorities are suggested review order, not vulnerability severity. No savings, compliance conclusion or purchasing approval is established. Human review is required.
CIO decision summary
| Provider | Readiness | Summary | Methodology |
|---|---|---|---|
| azure-devops | No evidence | Azure DevOps: no evidence. There is insufficient collected evidence to assess this provider. Prioritize evidence validation and ownership before committing spend. No defensible savings estimate or overall security-health rating can be derived from this snapshot. | Local rule-based analysis, not AI-generated advice. Based on the full collected provider scope, not screen filters. Priorities are suggested review order, not vulnerability severity. No savings, compliance conclusion or purchasing approval is established. Human review is required. |
CIO evidence
| Provider | Fact ID | Evidence |
|---|---|---|
| azure-devops | F1 | Source coverage: 0 included, 0 skipped; 0 observed provider identities, not licensed seats. |
| azure-devops | F2 | Inventory: 0 distinct repositories observed; 0 with unavailable activity and 0 with unknown or missing security-setting evidence. Inventory completeness is not independently verified. |
| azure-devops | F3 | Security review: 0 active repositories have at least one explicitly disabled collected setting. A disabled default setup does not rule out a custom pipeline; enablement is not scanning success. |
| azure-devops | F4 | Activity review: 0 repositories have zero observed default-branch commits in their complete collected windows. Windows can differ; inactivity is not proof a repository or license is unnecessary. |
| azure-devops | F5 | Financial evidence: 0 modeled pricing rows, 0 provider-count enablement estimates, 0 readable billing datasets of 0 requested, and 0 daily usage rows. Datasets and detail overlap; row counts are not seats. Modeled costs are not actual charges; billing usage is not an invoice or proof of payment. |
| azure-devops | F6 | Collection evidence: 0 partial, unavailable or not-requested dataset checks. Uncollected data is unknown, not zero. |
CIO recommendations
| Provider | Priority | Recommendation | Owner | Horizon | Fact IDs | Action |
|---|---|---|---|---|---|---|
| azure-devops | P1 | Close evidence gaps before a purchasing decision | Platform owner and reporting owner | Next 7 days | F1, F2, F6 | Confirm intended source coverage and review unavailable datasets. Request an authorized read-only export where access is missing; do not grant broader privileges merely to complete this report. |
| azure-devops | P1 | Reconcile modeled costs with entitlements and billing | FinOps and procurement | Before renewal or purchase | F1, F5 | Obtain per-product billable usage, Basic/Test Plans entitlements, included benefits, billing scope and contract prices. Validate organization-level identity deduplication before treating preview estimates as a purchase quantity. |
| azure-devops | P2 | Measure security outcomes, not only enablement | Security engineering | Next 30 days | F2, F3 | Collect last successful scans, severity and age of open findings, remediation times and branch-policy coverage. Agree targets by repository criticality; current settings alone cannot establish effectiveness or compliance. |
| azure-devops | P2 | Establish a repeatable baseline | Platform owner and FinOps | Next reporting cycle | F1, F4, F5 | Repeat the same source scope and date window after gaps are resolved. Compare authorized retained snapshots for usage, cost and remediation trends; this single snapshot does not establish improvement or savings. |
Recommended collection
| Provider | Dataset | Decision supported | Access and limits |
|---|---|---|---|
| azure-devops | Basic/Test Plans entitlements, included benefits and official billable committers | Establish actual purchase quantities and potential duplicate entitlements. | Review the collected billing snapshots and their coverage first. Seat entitlements and unresolved billing populations require an authorized owner export; this report does not establish complete license coverage. |
| azure-devops | Invoices, billing scope, contract prices and discounts | Reconcile scenarios to actual spend; quantify savings only after eligibility and contractual review. | Billing-owner-approved export. Do not include payment details or credentials. Not collected by this feature. |
| azure-devops | Last successful scans, finding severity/age and remediation times | Assess security effectiveness and prioritize remediation by business impact. | Existing security-report read access; collect aggregates, not source code or secret values. Not collected by this feature. |
| azure-devops | Repository owners, business criticality and branch protection/policies | Assign accountability and distinguish justified exceptions from control gaps. | Existing repository metadata read access and owner confirmation. Not collected by this feature. |
| azure-devops | Pipelines, Artifacts and parallel-job usage with entitlements | Assess non-security spend and utilization; keep compute/storage/AI usage separate from security licenses. | Existing usage-report access or authorized exports. Organization billing rows may cover some meters, but utilization and entitlement coverage are not established. |
Cross-provider identities are not automatically merged. Skipped sources are excluded from totals and listed with remediation above.
GitHub Enterprise
How to read this report
GitHub default-branch authored-date activity does not establish 90-day pushed-commit billing eligibility or Enterprise seat usage. Unknown does not mean free. Costs are monthly USD list-price scenarios, not a quote. Do not add subtotals to their component rows.
Executive summary
GitHub EnterpriseCollection at a glance (4 rows)
| Provider | Dataset | Collected | Interpretation |
|---|---|---|---|
| GitHub Enterprise | Source coverage | 0 included; 0 skipped | Included means some data was accessible, not that every dataset succeeded. |
| GitHub Enterprise | Repository inventory | 0 | 0 with complete default-branch activity. Visible scope only. |
| GitHub Enterprise | Provider billing datasets | Not recorded | Each product/period has separate status; unavailable is not zero. See coverage details. |
| GitHub Enterprise | Daily usage detail | 0 | Raw usage rows, not seats. Summarized separately below; do not add to monthly aggregates. |
No readable usage amounts were collected. Estimates are separate from actual charges.
Provider-reported billing and enablement evidence
Billing snapshots, enablement estimates and usage charges are separate datasets. Do not add overlapping scopes or summaries to detail.
Reported billing usage (0 rows)
No rows collected. Check collection coverage; this does not establish zero usage.
Usage and security evidence
Settings are current snapshots, not proof of recent scanning or payment. Reported billing usage is not an invoice; missing rows do not mean zero cost. Activity uses authored dates, excluding two automation accounts. Date windows are UTC; the final day may be incomplete.
Repository inventory (0 rows)
No rows collected. Check collection coverage; this does not establish zero usage.
Security settings (0 rows)
No rows collected. Check collection coverage; this does not establish zero usage.
Daily activity (0 rows)
No rows collected. Check collection coverage; this does not establish zero usage.
Collection evidence (0 rows)
No rows collected. Check collection coverage; this does not establish zero usage.
Source status
| Provider | Source | Status | Returned identity rows | Reason | How to fix | Scope |
|---|
Estimated billing
Public price assumptionsSolution pricing totals
Totals cover the full collected scope, not screen filters. Counts are product-specific estimates, not confirmed licensed seats. GHAS subtotals combine Code Security and Secret Protection costs; do not add subtotals to their component rows. Annualized estimates are monthly estimates x 12, not annual contract quotes. Other plans without usage evidence remain unpriced.
Pricing totals unavailable. No complete cost estimates were collected; this is not zero cost.
Evidence-based recommendations
CIO decision brief
Local rule-based analysis, not AI-generated advice. Based on the full collected provider scope, not screen filters. Priorities are suggested review order, not vulnerability severity. No savings, compliance conclusion or purchasing approval is established. Human review is required.
CIO decision summary
| Provider | Readiness | Summary | Methodology |
|---|---|---|---|
| github | No evidence | GitHub Enterprise: no evidence. There is insufficient collected evidence to assess this provider. Prioritize evidence validation and ownership before committing spend. No defensible savings estimate or overall security-health rating can be derived from this snapshot. | Local rule-based analysis, not AI-generated advice. Based on the full collected provider scope, not screen filters. Priorities are suggested review order, not vulnerability severity. No savings, compliance conclusion or purchasing approval is established. Human review is required. |
CIO evidence
| Provider | Fact ID | Evidence |
|---|---|---|
| github | F1 | Source coverage: 0 included, 0 skipped; 0 observed provider identities, not licensed seats. |
| github | F2 | Inventory: 0 distinct repositories observed; 0 with unavailable activity and 0 with unknown or missing security-setting evidence. Inventory completeness is not independently verified. |
| github | F3 | Security review: 0 active repositories have at least one explicitly disabled collected setting. A disabled default setup does not rule out a custom pipeline; enablement is not scanning success. |
| github | F4 | Activity review: 0 repositories have zero observed default-branch commits in their complete collected windows. Windows can differ; inactivity is not proof a repository or license is unnecessary. |
| github | F5 | Financial evidence: 0 modeled pricing rows, 0 provider-count enablement estimates, 0 readable billing datasets of 0 requested, and 0 daily usage rows. Datasets and detail overlap; row counts are not seats. Modeled costs are not actual charges; billing usage is not an invoice or proof of payment. |
| github | F6 | Collection evidence: 0 partial, unavailable or not-requested dataset checks. Uncollected data is unknown, not zero. |
CIO recommendations
| Provider | Priority | Recommendation | Owner | Horizon | Fact IDs | Action |
|---|---|---|---|---|---|---|
| github | P1 | Close evidence gaps before a purchasing decision | Platform owner and reporting owner | Next 7 days | F1, F2, F6 | Confirm intended source coverage and review unavailable datasets. Request an authorized read-only export where access is missing; do not grant broader privileges merely to complete this report. |
| github | P1 | Reconcile modeled costs with entitlements and billing | FinOps and procurement | Before renewal or purchase | F1, F5 | Obtain Enterprise seat assignments, official product-billable committer counts, billing scope and contract prices. Separate Enterprise seats, Code Security and Secret Protection; observed authors are not a billing population. |
| github | P2 | Measure security outcomes, not only enablement | Security engineering | Next 30 days | F2, F3 | Collect last successful scans, severity and age of open findings, remediation times and branch-policy coverage. Agree targets by repository criticality; current settings alone cannot establish effectiveness or compliance. |
| github | P2 | Establish a repeatable baseline | Platform owner and FinOps | Next reporting cycle | F1, F4, F5 | Repeat the same source scope and date window after gaps are resolved. Compare authorized retained snapshots for usage, cost and remediation trends; this single snapshot does not establish improvement or savings. |
Recommended collection
| Provider | Dataset | Decision supported | Access and limits |
|---|---|---|---|
| github | Enterprise seats, outside collaborators and official billable committers | Establish actual purchase quantities and potential duplicate entitlements. | Review the collected billing snapshots and their coverage first. Seat entitlements and unresolved billing populations require an authorized owner export; this report does not establish complete license coverage. |
| github | Invoices, billing scope, contract prices and discounts | Reconcile scenarios to actual spend; quantify savings only after eligibility and contractual review. | Billing-owner-approved export. Do not include payment details or credentials. Not collected by this feature. |
| github | Last successful scans, finding severity/age and remediation times | Assess security effectiveness and prioritize remediation by business impact. | Existing security-report read access; collect aggregates, not source code or secret values. Not collected by this feature. |
| github | Repository owners, business criticality and branch protection/policies | Assign accountability and distinguish justified exceptions from control gaps. | Existing repository metadata read access and owner confirmation. Not collected by this feature. |
| github | Actions, Packages and Copilot usage with entitlements | Assess non-security spend and utilization; keep compute/storage/AI usage separate from security licenses. | Existing usage-report access or authorized exports. Organization billing rows may cover some meters, but utilization and entitlement coverage are not established. |
Cross-provider identities are not automatically merged. Skipped sources are excluded from totals and listed with remediation above.
Report-wide collection warnings
- SYNTHETIC DEMO: all organizations, people, repositories and billing amounts are fictional. Not customer evidence or an invoice.