Microsoft: Host, Storefront and RivalNarrow moat

CrowdStrike (CRWD) — moat facet

Microsoft is CrowdStrike's host, its newest storefront and a rival that gives security away inside a bundle, all at once.

Microsoft stands in three places around CrowdStrike at once. It supplies the operating system on which most of the sensor's protected machines run; from fiscal 2027 it is a storefront, since CrowdStrike now sells through the Microsoft Marketplace as well as AWS and Google1; and it is a rival that bundles security into software customers already buy.

Microsoft in three rolesHost: Windows devices hit, 19 July 20248.5 millionStorefront: Microsoft Marketplacefrom FY2027Rival: daily security signals100 trillionRival: Entra monthly active usersover 1 billionMicrosoft blog; CrowdStrike FY2026 10-K; Zacks via Yahoo Finance, June 2026
The same company in three roles.

The first role is the one that made July 2024 so visible. The faulty update disabled Windows machines, and it was Microsoft that estimated the damage at 8.5 million devices2. That episode is covered on the outage pages of The Moat; the point here is dependence. A sensor that works deep inside Windows needs Microsoft's cooperation to keep working there.

The third role is the one that matters for price. Palo Alto's 10-K lists Microsoft among "large companies that incorporate security or observability features in their products"3. A June 2026 analysis noted that Microsoft 365 E5 and Copilot "both of which bundle security and compliance capabilities", that Microsoft's security stack processes 100 trillion signals a day and that Microsoft Entra has passed one billion monthly active users4. The same piece concluded that "neither CrowdStrike nor Palo Alto Networks can pair security with a dominant productivity or hyperscale cloud franchise"5.

A bundle is hard to beat on price, because the customer has already paid for it. CrowdStrike's own risk factors say rivals "may offer lower pricing than we do"6. Its answer is that a specialist on every machine is worth paying for twice, and the numbers so far support it: ARR grew 25% to $5.84 billion in the year to July 20267, while Microsoft was selling the bundle.

There is a fourth, smaller role as a partner. Microsoft Azure is one of eight AI gateway partners to which CrowdStrike extended its AI detection and response product in the second quarter8, alongside Databricks and Google Cloud.

This is a relationship CrowdStrike cannot leave and cannot win outright. Microsoft Entra's reach, more than one billion monthly users9, is the figure that frames it; if CrowdStrike's identity and SIEM modules stop gaining while Entra keeps growing, the bundle is winning the categories the platform needs next.

Moat trajectory: Holding steady

ARR +25% to $5.84bn while Microsoft bundles security into E5 and Copilot.

The number that tests this moat
Third-party estimate
Microsoft Entra monthly active users
More than 1 billion (June 2026)

The reach of the bundle CrowdStrike competes with in identity; growth there while CrowdStrike's identity modules stall would mean the bundle is winning.

Source: Microsoft security footprint (Zacks via Yahoo Finance) ↗
References
  1. ReportedIt supplies the operating system on which most of the sensor's protected machines run; from fiscal 2027 it is a storefront, since CrowdStrike now sells through the Microsoft Marketplace as well as AWS and Google; and it is a rival that bundles security into software customers already buy.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1 business: the Falcon platform, modules, markets, customers, channels, managed service providers, public sector, employees and the Onum and Pangea acquisitions. — FY2026 · publ. 5 March 2026 · source ↗
  2. Third-party estimateThe faulty update disabled Windows machines, and it was Microsoft that estimated the damage at 8.5 million devices.
    Microsoft blog, 20 July 2024 - CrowdStrike's update affected an estimated 8.5 million Windows devices, less than one percent of all Windows machines. — July 2024 · publ. 20 July 2024 · source ↗
  3. ReportedPalo Alto's 10-K lists Microsoft among "large companies that incorporate security or observability features in their products".
    Palo Alto Networks Form 10-K for fiscal 2026 - competitors in four categories, naming Alphabet, Cisco and Microsoft among large companies that incorporate security in their products and CrowdStrike, Check Point, Delinea, Fortinet, Okta, SailPoint and Zscaler among independent security vendors; and the CyberArk acquisition, booked at $21,061 million. — FY2026 (year to 31 July 2026) · publ. 10 September 2026 · source ↗
  4. Third-party estimateA June 2026 analysis noted that Microsoft 365 E5 and Copilot "both of which bundle security and compliance capabilities", that Microsoft's security stack processes 100 trillion signals a day and that Microsoft Entra has passed one billion monthly active users.
    Zacks via Yahoo Finance, 30 June 2026, on Microsoft's security business - Microsoft 365 E5 and Copilot bundle security and compliance capabilities, the security stack processes 100 trillion daily signals, Microsoft Entra has passed one billion monthly active users, and neither CrowdStrike nor Palo Alto can pair security with a productivity or hyperscale cloud franchise. — June 2026 · publ. 30 June 2026 · source ↗
  5. Third-party estimateThe same piece concluded that "neither CrowdStrike nor Palo Alto Networks can pair security with a dominant productivity or hyperscale cloud franchise".
    Zacks via Yahoo Finance, 30 June 2026, on Microsoft's security business - Microsoft 365 E5 and Copilot bundle security and compliance capabilities, the security stack processes 100 trillion daily signals, Microsoft Entra has passed one billion monthly active users, and neither CrowdStrike nor Palo Alto can pair security with a productivity or hyperscale cloud franchise. — June 2026 · publ. 30 June 2026 · source ↗
  6. ReportedCrowdStrike's own risk factors say rivals "may offer lower pricing than we do".
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1A risk factors and Item 3 legal proceedings: competition, the July 19 incident, customer commitment packages, insurance and litigation. — FY2026 · publ. 5 March 2026 · source ↗
  7. ReportedIts answer is that a specialist on every machine is worth paying for twice, and the numbers so far support it: ARR grew 25% to $5.84 billion in the year to July 2026, while Microsoft was selling the bundle.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  8. ReportedMicrosoft Azure is one of eight AI gateway partners to which CrowdStrike extended its AI detection and response product in the second quarter, alongside Databricks and Google Cloud.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - second-quarter results, ARR, net new ARR, margins, module adoption and recent highlights. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  9. Third-party estimateMicrosoft Entra's reach, more than one billion monthly users, is the figure that frames it; if CrowdStrike's identity and SIEM modules stop gaining while Entra keeps growing, the bundle is winning the categories the platform needs next.
    Zacks via Yahoo Finance, 30 June 2026, on Microsoft's security business - Microsoft 365 E5 and Copilot bundle security and compliance capabilities, the security stack processes 100 trillion daily signals, Microsoft Entra has passed one billion monthly active users, and neither CrowdStrike nor Palo Alto can pair security with a productivity or hyperscale cloud franchise. — June 2026 · publ. 30 June 2026 · source ↗
Sources
Generated September 28, 2026