Purchase control options in Azure Marketplace
The following purchase control options are available in Azure Marketplace:
- Control purchases through the billing profile (direct customers)
- Control purchases through EA (Enterprise Agreement) billing administration
- Use Azure policy to control virtual machine deployment
- Enable private Azure Marketplace
Purchase control through the billing profile under a Microsoft Customer Agreement (MCA)
Apply policies to control marketplace purchases through your billing profile. You can set policies to disable or enable marketplace product purchases. When the policies are applied, subscriptions that are billed to the billing profile can't be used to make these purchases. You can choose from three different options:
Free + Paid: allows users to acquire any Azure Marketplace application.
Free: allows users to deploy only free software from Azure Marketplace.
No: prevents users from deploying applications from Azure Marketplace.
Purchase control through EA billing administration under an Enterprise Agreement (EA)
Enterprise administrators can enable or disable Azure Marketplace purchases for all Azure subscriptions under their enrollment through policy settings in Cost Management + Billing.
Off: disables Azure Marketplace.
On: enables Azure Marketplace, users with assigned permissions can purchase.
Free/BYOL SKUs only: users can only deploy free and BYOL (Bring Your Own License) applications.
Control virtual machine deployments with Azure policy
You can use Azure policy to control virtual machine deployments through Azure Marketplace to purchase and deploy only approved virtual machine images, including:
- Vendor specific: Only letting virtual machines from certain software vendors be deployed on the subscription. For example, create a policy that only allows deployment of VMs (Virtual Machine) published by Microsoft or VMs published only by a specific software vendor.
- Operating system: only letting either Windows or Linux resources be deployed on the subscription
- Version: only allowing specific versions of resources to be deployed on the subscription
- Size: only letting users deploy virtual machines up to a certain size on the subscription
- Location: only letting resources be deployed from specific global regions
For details on how to enforce policy to Windows VMs, see apply policies to Windows VMs with Azure Resource Manager.
Purchase control by enabling private Azure Marketplace
Private Azure Marketplace is a service at the tenant level that enables administrators to govern which Microsoft partner solutions users can purchase and deploy. It does this by letting a user deploy only offers approved by the marketplace administrator. For private Azure Marketplace, the tenant Global administrator must assign the Marketplace admin role to the private Azure Marketplace admin who enables and manages the private store. See Create and manage private Azure Marketplace collections in the Azure portal to learn how to enable private Azure Marketplace.
Purchase control in Microsoft AppSource
When purchasing an application in Microsoft AppSource, you can pay with a credit card or choose to purchase the application using your Azure subscription. During the checkout experience in Microsoft AppSource, select whether you want to pay with a credit card or select to purchase using your Azure subscription.
If you purchase using an Azure subscription, you are directed from Microsoft AppSource into the Azure portal. Any purchase controls implemented in Azure Marketplace govern purchases made in the Azure portal.
