It’s precisely this, and, to be fair, it’s a rational approach given a Data Security Exhibit starts at 6 weeks and can hit 6 months to complete. That being said, I work with regulated data, so YMMV.

But if the org already has an agreement with Anthropic (and many do) then why pay GitHub…

Plus if you're in government you have procurement to deal with. You already have an Enterprise deal with Microsoft so you don't have to go through any of that rigmarole.

Can confirm, this is the situation.

Microsoft is simply the default answer for most large corporations. Getting access to some Microsoft subscription is very easy, because of the existing framework agreements, Microsoft providing any and all compliance slopuments needed and already being pre-cleared for corporate data etc. Meanwhile trying to use another provider (e.g. Anthropic) would be a one year endeavor, minimum.