Procurement playbook - How to drive custom deals on Azure Marketplace
Azure Marketplace offers an excellent opportunity to maximize your investment in Azure while also exploring other solutions that might better fit your needs. However, B2B commerce on a cloud environment comes with its own set of complexities and considerations. This document provides a procurement-person's best practices for maximizing the potential of Azure Marketplace.
Before you begin
It's important to understand the basic concepts of Azure before using Azure Marketplace. These concepts include:
Billing accounts and subscriptions: A billing account manages your costs and invoices, while subscriptions are the operational entities on which your Azure resources run. Each billing account has one or more subscriptions. It is important to note that having admin permissions to a billing account does not grant permission to its subscriptions, and vice versa. These permissions are configured independently of each other.
To purchase a product from the marketplace (free or paid) requires deploying a resource and associating it with an Azure subscription. The Azure subscription is part of the primary billing unit on your invoice. Therefore, you must be a subscription owner or contributor to complete a purchase.
Azure subscription and SaaS subscription are two different things. An Azure subscription is an Azure construct for the purposes described previously. A SaaS subscription is a marketplace product that is purchased for a defined period of time and has its own life cycle and behavior. One Azure subscription can be used to purchase and manage multiple SaaS subscriptions.
When you ask for a private offer agreement with a publisher, you need to provide your billing account ID. The private offer applies to all the subscriptions under the billing account you provided.
Understanding your account settings
This section provides an overview of the settings required to complete a purchase and how to find them.
What it takes to complete a purchase
To complete a purchase of private offers, you must complete two steps: accept and purchase. Accepting requires billing account admin permissions, while purchasing requires subscription owner or contributor permissions.
For SaaS products, activating a SaaS subscription is done at the publisher's portal and requires Microsoft Entra permissions to perform single sign-on to third-party products. See more information on configuring how users consent to applications.
Find your permissions and account settings
You can find your subscription permissions and the billing account they're associated with in the Marketplace private offers precheck tool. It scans your account and provides you with necessary information about potential setting you need to address:
- Private marketplace: If private marketplace is enabled on your tenant, the product you plan to buy should be in the allowlist
- Azure policies - Your organization might have policies blocking marketplace of policies enforcing specific tagging when creating a resource. To learn how to address this issue, see Private offers precheck: eligibility check results.
After you decide on the subscription, make sure your subscription has been registered for marketplace RP, otherwise you won't be able to use it for any deployment. In Azure portal, go to: Subscriptions > select the subscription > resource providers > filter by the word "marketplace" > make sure all three results are enabled for Azure Marketplace.
To find your billing account permissions, go to the Azure portal and select Cost Management & Billing > Billing Scopes > (select the billing account you want) > Access Management (IAM).
If you don't see the billing account you're looking for, it means you don't have permission to it (including read-only permissions). To learn more, see Billing accounts and scopes in the Azure portal.
To find if you can register third-party applications via SSO, check on Microsoft Entra ID menu that users can register applications (Activating your SaaS service requires SSO permissions to third party apps):
To learn more, see Configure how users consent to applications - Microsoft Entra | Microsoft Learn.
If you don't have the necessary permissions, you need to find someone in your organization who has them. In some organizations, there's a need for two or three different people who have each of the permissions. These people need to take the actual actions to complete the purchase.
Decide on the preferred purchase setup
It's recommended to know in advance on which subscriptions you want the resource (for example, SaaS) to run and check who has permissions for it. If you prefer to create a new subscription for the purchase, create it in advance and make yourself an owner of this subscription.
Some customers prefer to create one "bucket-subscription" for all marketplace purchases and give the procurement person permissions to it. This enables the procurement person to complete all transactions by themselves. The purchases can later be moved to other subscriptions so they can be reflected under the correct cost centers.
Governance and control of products inventory
Are you looking to enable marketplace products within your organization, yet wish to avoid unrestricted access to the entire marketplace catalog? Azure Private Marketplace provides a solution. It allows you to curate subsets of products tailored to your organization or even specific teams at the subscription level.
The Azure Private Marketplace operates on three fundamental principles:
- Upon enabling the private marketplace at the tenant level, all marketplace products are, by default, blocked for purchase.
- Any user within your organization can submit a request to add a product to the private marketplace's allowlist.
- The marketplace administrator receives these requests and has the authority to approve or decline them.
- Private offers can be automatically enabled in the marketplace, if you have configured it this way.
Procurement management
There are certain limitations to be aware of:
The Azure Marketplace doesn't possess its own role-based access control (RBAC) system for purchases. Instead, the RBAC operates at the subscription level, meaning anyone with subscription owner/contributor permissions can make purchases in the marketplace.
Currently, the Azure Marketplace doesn't offer out-of-the-box integration with enterprise procurement or workflow systems.
If your organization adheres to specific procurement policies and procedures, these procedures should be managed externally to the Azure portal. Examples of the procedures include: identifying who authorizes purchases, establishing approval hierarchies, and determining who executes the purchase.
The Private Marketplace offers a degree of control over individual purchases by enabling products on an on-demand basis. Once all procedural approvals have been granted, the marketplace administrator can make a product available for purchase. Once the purchase is completed, the product is then removed from the Private Marketplace, remaining unavailable until the next purchase request is made.
Completing a private offer
Understanding the fundamentals of private offers
As mentioned previously, each private offer involves two steps: acceptance and purchase. While the purchase can occur immediately after acceptance, it isn't mandatory, provided it happens between the private offer's start and end dates.
Financial transactions in Azure billing aren't started when you accept a private offer. To finalize the deal, a purchase (full product deployment and activation) must occur.
The term of the private offer (start/end dates) is NOT identical to the SaaS subscription term.
- A private offer might be active for a brief period to facilitate the SaaS purchase.
- Once purchased, a seat-based SaaS subscription continues under the negotiated terms of the private offer until expiration.
- A metered SaaS service is billed at a discounted price only during the private offer period. Hence, if you're negotiating for a metered SaaS, ensure the private offer term aligns with the SaaS subscription term.
As the SaaS subscription nears expiration, the publisher can issue a new private offer with different terms (again, it can be only for a brief window) to allow renewal under updated conditions. If the customer accepts the private offer and renews the SaaS subscription, the new price and terms are locked in for the entire duration of the SaaS subscription.
Currently, flexible (uneven) payment plans aren't supported under a single private offer. To construct an uneven payment plan, you can play a workaround by creating several private offers, as shown in the following example. (Note: this workaround isn't ideal. It comes with an overhead of managing overlapping private offers. Consider this overhead before using this workaround):
Example:
A three-year SaaS subscription
Total cost: $1M
Commencing on March 1, 2023, and concluding on March 1, 2026.
The desired payment plan is 40% in the first year, 50% in the second year, and 10% in the third year.
Solution: Create three private offers:
- PO1: Start date - February 20, 2023, End date - March 10, 2023. SaaS subscription term: One year. Price: $400,000.
- PO2: Start date - February 20, 2024, End date - March 10, 2024. SaaS subscription term: One year. Price: $500,000.
- PO3: Start date - February 20, 2025, End date - March 10, 2025. SaaS subscription term: One year. Price: $100,000.
All three private offers can be created and accepted simultaneously in 2023. Each private offer comes into effect when its time arrives, and the SaaS renewal occurs under the new private offer's terms.
If no private offer is active at the time of SaaS renewal, the SaaS service continues to operate at the list price (no discounts will be applied).
Customers can opt to make a purchase under one Azure subscription and later transfer the resource to a different subscription, as outlined in the Understand your account settings section. In this scenario, all future payments are attributed to the new subscription, while past payments are recorded under the original subscription. This means that you can't allocate 100% of the cost under the new subscription, as the purchase immediately impacts billing for the first installment.
Billing and invoicing
To understand billing account types and structures, refer to this guide: Billing accounts and scopes in the Azure portal.
Marketplace purchases appear as individual line items on your Azure invoice.
If you wish to generate an individual invoice for a specific Marketplace purchase, your options vary between the two primary account types:
Enterprise Agreement (EA) Accounts:
Currently, you can't generate separate invoices for individual marketplace purchases for EA customers. The only supported format is the consolidated invoice.
The invoice is generated with a Purchase Order number (PO#) at the header of the invoice. The PO# is set at the billing account level, and there's no option to use different PO#s for different marketplace purchases.
Microsoft Customer Agreement (MCA) Accounts:
Customers with MCA accounts can create multiple billing profiles under their billing account. In such cases, the invoice is generated for each billing profile. For example, a customer with one billing account and three billing profiles receive three separate invoices. Each invoice can have a different PO#.
If you wish to receive a separate invoice for a specific purchase, you can create a new billing group, create or move an Azure subscription under it, and then purchase the SaaS product under that subscription.
Microsoft Azure consumption commitment (MACC)
Many but not all products in the marketplace are MACC eligible. You can filter them using the "Azure benefit eligible" option or look for the cash icon on the offer tiles.
Best practices - real life scenario of private offers
Lorenzo's journey: Procuring software via Azure Marketplace
Lorenzo is a procurement officer at Adatum Corporation. He's finalized an agreement with Maya, a sales representative from a software publisher named Contoso. Lorenzo prefers to close the deal via Azure Marketplace to decrement his Microsoft Azure Consumption Commitment (MACC). Here's how his journey unfolds:
Lorenzo starts by confirming that the offer he's interested in is MACC eligible. He knows that while purchasing non-MACC offers is possible, they won't decrement his MACC.
Next, Lorenzo coordinates with Adatum Corporation's IT division, who initially requested the software. He finds out which Azure subscription they plan to use for the software deployment. The subscription owner runs the private offers precheck tool on their account and provides Lorenzo with the billing account ID.
In the case Adatum Corporation prefers to centralize software purchases on a single subscription, Lorenzo would check if he has permissions for this subscription. If not, he identifies someone who does to assist with the purchase process. Regardless, the subscription owner needs to provide Lorenzo with the billing account ID.
Lorenzo checks the billing account ID to see if he has permissions for it. If he's not a billing admin, he finds someone who is.
Lorenzo then provides the billing account ID to Maya. In return, Maya sends Lorenzo an email with a link to accept the private offer.
Assuming Lorenzo has the necessary permissions (EA admin, subscription owner, and Microsoft Entra ID), he selects the link Maya sent, verifies the offer details, and accepts the private offer.
He's then redirected to the Private Offer Management (POM) menu to complete the purchase. Here, he sees the private offer he just accepted. Selecting it opens the product details.
Lorenzo selects Purchase. A checkout pane opens, displaying the purchase options preselected by Maya, all locked for editing: product, plan, term, meter units, seats-range, and price.
If the Purchase button is disabled, Lorenzo follows the tool tip guidance to troubleshoot the issue. Possible reasons can be that the private offer has not being accepted yet, the current date being outside the offer's start and end dates, or the private offer not being ready for purchase.
On the checkout pane, Lorenzo selects a subscription (after verifying the global subscription filter is set up to include all the subscriptions), resource group, and other required data. He selects Subscribe and waits until the Configure your account button is enabled on the screen.
Once the button is enabled, Lorenzo selects it and completes the SaaS activation. The purchase is complete, and Lorenzo has successfully procured the software for Adatum Corporation via Azure Marketplace.
