Purchase control options in Microsoft Marketplace

The following purchase control options are available in Microsoft Marketplace:

• Control purchases through the billing profile (direct customers)
• Control purchases through EA (Enterprise Agreement) billing administration
• Use Azure policy to control virtual machine deployment
• Enable private Marketplace within Azure portal

Purchase control through the billing profile under a Microsoft Customer Agreement (MCA)

Apply policies to control Marketplace purchases through your billing profile. You can set policies to disable or enable Marketplace product purchases. When the policies are applied, subscriptions that are billed to the billing profile can't be used to make these purchases. You can choose from three different options:

• Free + Paid: allows users to acquire any Marketplace application.

• Free: allows users to deploy only free software from Marketplace.

• No: prevents users from deploying applications from Marketplace.

  

Purchase control through EA and MCA billing administration

EA (Enterprise agreement) accounts

Enterprise administrators can enable or disable Marketplace purchases for all Azure subscriptions under their enrollment through policy settings in Cost Management + Billing.

• Off: disables Marketplace.

• On: enables Marketplace, users with assigned permissions can purchase.

• Free/BYOL SKUs only: users can only deploy free and BYOL (Bring Your Own License) applications.

  

  MCA accounts

MCA accounts enable control over Marketplace on the billing profile levels. If you're a billing administrator, you can find this setup. The lingo is somewhat different than EA accounts, where "Free" applies for BYOL SKUs as well.

Control virtual machine deployments with Azure policy

You can use Azure policy to control virtual machine deployments through Marketplace to purchase and deploy only approved virtual machine images, including:

• Vendor specific: Only letting virtual machines from certain software vendors be deployed on the subscription. For example, create a policy that only allows deployment of VMs (Virtual Machine) published by Microsoft or VMs published only by a specific software vendor.
• Operating system: only letting either Windows or Linux resources be deployed on the subscription
• Version: only allowing specific versions of resources to be deployed on the subscription
• Size: only letting users deploy virtual machines up to a certain size on the subscription
• Location: only letting resources be deployed from specific global regions

For details on how to enforce policy to Windows VMs, see apply policies to Windows VMs with Azure Resource Manager.

Purchase control by enabling private Marketplace within Azure portal

Private Marketplace within Azure portal is a service at the tenant level that enables administrators to govern which Microsoft partner solutions users can purchase and deploy. It does this by letting a user deploy only offers approved by the Marketplace administrator. For private Marketplace within Azure portal, the tenant Global administrator must assign the Marketplace admin role to the private Marketplace admin who enables and manages the private store. See Create and manage private Marketplace collections in the Azure portal to learn how to enable private Marketplace within Azure portal.

Purchase control in Microsoft Marketplace

When purchasing an application in Microsoft Marketplace, you can pay with a credit card or choose to purchase the application using your Azure subscription. During the checkout experience in Microsoft Marketplace, select whether you want to pay with a credit card or select to purchase using your Azure subscription.

If you purchase using an Azure subscription, you're directed from Microsoft Marketplace into the Azure portal. Any purchase controls implemented in Marketplace govern purchases made in the Azure portal.