Procurement playbook - How to drive custom deals on Azure Marketplace
Azure Marketplace offers an excellent opportunity to maximize your investment in Azure while also exploring other solutions that might better fit your needs. However, B2B commerce on a cloud environment comes with its own set of complexities and considerations. This article provides procurement best practices for maximizing the potential of Azure Marketplace.
Before you begin
It's important to understand the basic concepts of Azure before using Azure Marketplace. These concepts include:
Billing accounts and subscriptions: A billing account manages your costs and invoices, while subscriptions are the operational entities on which your Azure resources run. Each billing account has one or more subscriptions. It is important to note that having admin permissions to a billing account doesn't grant permission to its subscriptions, and vice versa. These permissions are configured independently of each other.
To purchase a product from the marketplace (free or paid), it requires that you deploy a resource and associate it with an Azure subscription. The Azure subscription is part of the primary billing unit on your invoice. So, you must be a subscription owner or contributor to complete a purchase.
Azure subscription and SaaS subscription are two different things. An Azure subscription is an Azure construct for the purposes described previously. A SaaS subscription is a marketplace product that customers purchase for a defined period of time. It has its own life cycle and behavior. You can use one Azure subscription to purchase and manage multiple SaaS subscriptions.
When you ask for a private offer agreement with a publisher, you need to provide your billing account ID. The private offer applies to all the subscriptions under the billing account you provide.
Account settings overview
This section provides an overview of the settings required to complete a purchase and how to find them.
What it takes to complete a purchase
To complete a purchase of private offers, you must complete two steps: accept and purchase. Accepting requires billing account admin permissions, while purchasing requires subscription owner or contributor permissions.
For SaaS products, activating a SaaS subscription is done at the publisher's portal and requires Microsoft Entra permissions to perform single sign-on to non-microsoft products. See more information on configuring how users consent to applications.
Your permissions and account settings
You can find your subscription permissions and the billing account they're associated with in the Marketplace private offers precheck tool. It scans your account and provides you with necessary information about potential settings you need to address.
- Private marketplace: If private marketplace is enabled on your tenant, the product you plan to buy should be in the allowlist.
- Azure policies - Your organization might have policies blocking marketplace or policies enforcing specific tagging when creating a resource. For more information on how to address this issue, see Private offers precheck: eligibility check results.
After you decide on the subscription, be sure your subscription is registered for Marketplace Resource Provider, or you won't be able to use it for any deployment. In Azure portal, go to: Subscriptions > select the subscription > resource providers > filter by the word "marketplace" > make sure all three results are enabled for Azure Marketplace.
To find your billing account permissions, go to Azure portal and select Cost Management & Billing > Billing Scopes > (select the billing account you want) > Access Management (IAM).
If you don't see the billing account you're looking for, it means you don't have permission to it, including read-only permissions. For more information, see Billing accounts and scopes in Azure portal.
To find out if you can register non-Mircrosoft applications with SSO, check the Microsoft Entra ID menu to see if users can register applications. Activating your SaaS service requires SSO permissions to non-Microsoft apps.
For more information, see Configure how users consent to applications.
If you don't have the necessary permissions, you need to find someone in your organization who has them. In some organizations, there's a need for two or three different people who have each of the permissions. These people need to take the actual actions to complete the purchase.
Preferred purchase setup
We recommend that you identify, in advance, the subscriptions you want the resource (for example, SaaS) to run. Then, check who has permissions for the subscriptions. If you prefer to create a new subscription for the purchase, create it in advance and make yourself an owner of the subscription.
Some customers prefer to create one "bucket-subscription" for all marketplace purchases and give the procurement person permissions to it. It enables the procurement person to complete all transactions by themselves. The purchases can later be moved to other subscriptions so they can be reflected under the correct cost centers.
Governance and control of products inventory
Are you looking to enable marketplace products within your organization, yet wish to avoid unrestricted access to the entire marketplace catalog? Azure Private Marketplace provides a solution. It helps you to curate subsets of products tailored to your organization or even specific teams at the subscription level.
The Azure Private Marketplace operates on three fundamental principles:
- You enable the private marketplace at the tenant level, then all marketplace products are, by default, blocked for purchase.
- Any user within your organization can submit a request to add a product to the private marketplace's allowlist.
- The marketplace administrator receives these requests and has the authority to approve or decline them.
- Private offers can be automatically enabled in the marketplace, if you configured it this way.
Procurement management
There are certain limitations to be aware of:
Azure Marketplace doesn't possess its own role-based access control (RBAC) system for purchases. Instead, the RBAC operates at the subscription level, meaning anyone with subscription owner/contributor permissions can make purchases in the marketplace.
Currently, Azure Marketplace doesn't offer out-of-the-box integration with enterprise procurement or workflow systems.
If your organization adheres to specific procurement policies and procedures, these procedures should be managed externally to Azure portal. Examples of the procedures include: identifying who authorizes purchases, establishing approval hierarchies, and determining who executes the purchase.
The Private Marketplace offers a degree of control over individual purchases by enabling products on an on-demand basis. Once all procedural approvals are granted, the marketplace administrator can make a product available for purchase. Once the purchase is completed, the product is then removed from the Private Marketplace, remaining unavailable until the next purchase request is made.
Private offers and their fundamentals
As mentioned, each private offer involves two steps: acceptance and purchase. While the purchase can occur immediately after acceptance, it isn't mandatory, provided it happens between the private offer's start and end dates.
Financial transactions in Azure billing aren't started when you accept a private offer. To finalize the deal, a purchase (full product deployment and activation) must occur.
The term of the private offer (start/end dates) is NOT identical to the SaaS subscription term.
- A private offer might be active for a brief period to facilitate the SaaS purchase.
- A license-based SaaS subscription that you purchase continues under the negotiated terms of the private offer until expiration.
- A metered SaaS service is billed at a discounted price only during the private offer period. Hence, if you're negotiating for a metered SaaS, ensure the private offer term aligns with the SaaS subscription term.
As the SaaS subscription nears expiration, the publisher can issue a new private offer with different terms (again, it can be only for a brief window) to allow renewal under updated conditions. If the customer accepts the private offer and renews the SaaS subscription, the new price and terms are locked in for the entire duration of the SaaS subscription.
Currently, flexible (uneven) payment plans aren't supported under a single private offer. To construct an uneven payment plan, you can do a workaround by creating several private offers, as shown in the following example.
Note
This workaround isn't ideal. It comes with the overhead of managing overlapping private offers. Consider the added overhead before using this workaround.
Example:
A three-year SaaS subscription
Total cost: $1M
Commencing on March 1, 2023, and concluding on March 1, 2026.
The desired payment plan is 40% in the first year, 50% in the second year, and 10% in the third year.
Solution: Create three private offers:
- PO1: Start date - February 20, 2023, End date - March 10, 2023. SaaS subscription term: One year. Price: $400,000.
- PO2: Start date - February 20, 2024, End date - March 10, 2024. SaaS subscription term: One year. Price: $500,000.
- PO3: Start date - February 20, 2025, End date - March 10, 2025. SaaS subscription term: One year. Price: $100,000.
All three private offers are created and accepted simultaneously in 2023. Each private offer comes into effect when its time arrives. The SaaS renewal occurs under the new private offer's terms.
If no private offer is active at the time of SaaS renewal, the SaaS service continues to operate at the list price. No discounts apply.
Customers can opt to make a purchase under one Azure subscription and later transfer the resource to a different subscription, as outlined in the Understand your account settings section. In this scenario, all future payments are attributed to the new subscription, while past payments are recorded under the original subscription. This means that you can't allocate 100% of the cost under the new subscription, as the purchase immediately impacts billing for the first installment.
Billing and invoicing
To understand billing account types and structures, refer to this guide: Billing accounts and scopes in Azure portal.
Marketplace purchases appear as individual line items on your Azure invoice.
If you wish to generate an individual invoice for a specific marketplace purchase, your options vary between the two primary account types:
Enterprise Agreement (EA) Accounts:
Currently, you can't generate separate invoices for individual marketplace purchases for EA customers. The only supported format is the consolidated invoice.
The invoice is generated with a Purchase Order number (PO number) at the header of the invoice. The PO number is set at the billing account level. There's no ability to use different PO numbers for different marketplace purchases.
Microsoft Customer Agreement (MCA) Accounts:
Customers with MCA accounts can create multiple billing profiles under their billing account. In such cases, the invoice is generated for each billing profile. For example, a customer with one billing account and three billing profiles receives three separate invoices. Each invoice can have a different PO number.
If you wish to receive a separate invoice for a specific purchase, you can create a new billing group, create or move an Azure subscription under it, and then purchase the SaaS product under that subscription.
Microsoft Azure consumption commitment (MACC)
Many but not all products in the marketplace are MACC eligible. You can filter them using the Azure benefit eligible option or look for the cash icon on the offer tiles.
Best practices - real life scenario of private offers
Lorenzo's journey: Procuring software in Azure Marketplace
Lorenzo is a procurement officer at Adatum Corporation, who finalized an agreement with Maya, a sales representative from a software publisher named Contoso. Lorenzo prefers to close the deal in Azure Marketplace to decrement the Microsoft Azure Consumption Commitment (MACC). Here's how Lorenzo's journey unfolds:
Lorenzo starts by confirming that the offer is MACC eligible. Lorenzo knows that while purchasing non-MACC offers is possible, it doesn't decrement the MACC.
Next, Lorenzo coordinates with Adatum Corporation's IT division, who initially requested the software. Lorenzo finds out which Azure subscription they plan to use for the software deployment. The subscription owner runs the private offers precheck tool on their account and provides Lorenzo with the billing account ID.
If Adatum Corporation prefers to centralize software purchases on a single subscription, Lorenzo checks if the permissions for this subscription allow it. If not, Lorenzo identifies someone who does have the right permissions to assist with the purchase process. At any rate, the subscription owner needs to provide Lorenzo with the billing account ID.
Lorenzo checks the billing account ID to see if there are the right permissions for it. If Lorenzo's not a billing admin, Lorenzo finds someone who is.
Lorenzo then provides the billing account ID to Maya. In return, Maya sends Lorenzo an email with a link to accept the private offer.
Assuming Lorenzo has the necessary permissions (EA admin, subscription owner, and Microsoft Entra ID), Lorenzo selects the link Maya sent, verifies the offer details, and accepts the private offer.
Lorenzo's then redirected to the Private Offer Management (POM) menu to complete the purchase. Here, Lorenzo sees the private offer the team accepted and selects it, which opens the product details.
Lorenzo selects Purchase. A checkout pane opens, displaying the purchase options preselected by Maya, which are locked for editing: product, plan, term, meter units, license-range, and price.
If the Purchase button is disabled, Lorenzo follows the tool tip guidance to troubleshoot the issue. Possible reasons are that the private offer isn't accepted yet. The current date is outside the offer's start and end dates or the private offer isn't ready for purchase.
On the checkout pane, Lorenzo selects a subscription (after verifying the global subscription filter is set up to include all the subscriptions), resource group, and other required data. Lorenzo selects Subscribe and waits until the Configure your account button enables on the screen.
After the button enables, Lorenzo selects it and completes the SaaS activation. The purchase is complete. Lorenzo successfully procured the software for Adatum Corporation in Azure Marketplace.
