Your Board Measures Cloud Spend — It Should Measure Microsoft Dependency.

Most boards can tell you whether cloud spending is above budget.

Far fewer can tell you what percentage of the enterprise’s identity, collaboration, security, data, infrastructure and artificial-intelligence strategy now depends on one supplier.

That distinction matters because vendor spend is not the same as vendor dependency.

A company may spend heavily with Microsoft and still retain strong architectural and commercial options. Another may spend less but rely on Microsoft for every employee identity, every collaboration workflow, critical cloud workloads, security telemetry, data governance and the context powering its AI agents.

The second company may have the greater concentration risk even though its invoice is smaller.

For 30 years, I have watched Microsoft relationships become broader while enterprise governance remained organized by budget line. Licensing sits with sourcing. Azure sits with the cloud team. Security sits with the CISO. Support sits with operations. Copilot sits with an AI steering committee.

Microsoft sees one connected platform. The board often sees five unrelated investments.

Deep integration can create real value. Microsoft 365 connects productivity and collaboration. Entra provides identity and access control across Microsoft cloud services. Microsoft Graph links people, files, mail, calendars, devices and security signals. Azure and Fabric extend the relationship into infrastructure, analytics and data. Copilot and agents use that context to reason and act.

The strategic advantage is also the source of concentration.

When identity, data and workflows share the same platform, a commercial decision in one area can affect options in another. A security consolidation can strengthen the case for a broader license suite. A Fabric deployment can influence future data architecture. A Copilot rollout can make Microsoft-hosted context more valuable. An Azure commitment can shape which applications receive investment.

None of those decisions is inherently wrong. The governance failure is evaluating each one without measuring their combined effect on enterprise optionality.

Boards already understand this principle in other forms. They review customer concentration, supply-chain concentration, refinancing exposure and key-person risk. Technology-platform concentration deserves the same attention because it can affect cost, resilience, innovation and negotiating leverage at once.

I recommend starting with a financial measure:

Microsoft Dependency Ratio = Licensing + Azure + support + AI commitments divided by total addressable IT spend

“Addressable” is important. The denominator should include technology categories for which Microsoft is a realistic supplier or architectural influence, not facilities, payroll or unrelated operating expenses.

The ratio creates a board-level trend line. Is Microsoft-controlled spend becoming a larger share of the enterprise technology base? How will the proposed renewal change that share over three years? What portion is contractually committed versus variable?

But the financial ratio is only the first layer. Dependency must also be measured operationally.

The scorecard should not produce a single red or green answer. Concentration may be intentional. The board’s job is to determine whether the company has priced the risk, assigned ownership and preserved sufficient alternatives.

Trend matters more than a one-time score. A moderate dependency profile that is accelerating across three contract cycles may deserve more attention than a high but stable concentration supported by tested controls. The board should therefore review the ratio alongside the direction of travel, the next major commitment date and the time required to create an alternative.

Whenever dependency is raised, the discussion tends to swing toward migration. That is the wrong starting point.

The objective is not to make Microsoft unimportant. It is to prevent importance from becoming ungoverned control.

Enterprises can preserve optionality in practical ways:

• Maintain current inventories of data location, integration points and identity dependencies.
• Use documented portability standards for critical data and AI context.
• Separate contracts and renewal dates where bundling would eliminate negotiating leverage.
• Retain independent expertise in licensing, architecture and enterprise support.
• Test restoration and continuity plans that do not assume every Microsoft control plane is available.
• Avoid consumption commitments that require speculative growth to achieve their economics.
• Establish exit rights and transition assistance before an AI or platform deployment becomes material.

These are not anti-Microsoft controls. They are normal governance for a strategic supplier.

Microsoft itself says its cloud provides integration across the technology stack and that its future growth depends on moving beyond traditional product categories and business models. Customers should expect that strategy to continue. Their governance model should be equally integrated.

Boards tend to focus on contract term because it is visible. A three-year agreement has a start date, end date and committed value.

Architecture can create a longer commitment without an expiration date.

Once applications depend on a specific identity layer, employees collaborate inside one data graph, security teams build processes around one telemetry stack and AI agents learn to operate through one context layer, the cost of change becomes organizational rather than contractual.

That is not necessarily bad. It may be the price of standardization. But it should be recognized as capital allocation, not treated as a routine product rollout.

The most consequential Microsoft decision in the next board cycle may not be the EA renewal. It may be the point at which enterprise context becomes too interconnected to move at a commercially useful speed.

The CIO and CFO should present Microsoft exposure together at least annually and before major renewals. The CISO should explain where Microsoft concentration improves control and where it creates correlated risk. Procurement should show which categories remain competitively contestable. Legal should identify commitments, data rights and transition obligations that survive the contract term.

The board does not need product-level detail. It needs to understand trajectory, concentration and reversibility.

Three questions should be visible on the scorecard:

1. Where is Microsoft dependency growing faster than the business value it creates?
2. Which critical capabilities could we operate, support or source independently within 12 months?
3. What decision are we making today that will be expensive to reverse three years from now?

Spend management asks whether the company can afford Microsoft.

Dependency management asks whether the company can still govern the relationship.

Boards should measure both.