July 16, 2026

Azure Marketplace onboarding: what a purchase does to your bill and your MACC

Buying third-party software through Azure Marketplace looks like a procurement shortcut, and it usually is. The purchase lands on the same Azure invoice as your infrastructure, the billing relationship stays with Microsoft, and you avoid standing up a separate vendor payment. But from a FinOps seat the mechanics are not obvious, and the questions that show up after the first renewal are almost always about where the charge landed, whether it counted toward your commitment, and why it carries no resource tags. The Azure Marketplace overview documents the storefront, but the billing behavior depends on the offer type, and the offer type is the thing nobody writes down.

Offer types, in plain terms

Marketplace groups third-party products into offer types, and the type determines how the product deploys and how it bills. SaaS offers are fulfilled by the publisher but transacted through Azure. The customer subscribes, the publisher provisions the tenant, and billing stays on the Azure side. Azure Application offers, often called managed applications, deploy Azure resources directly into your subscription. Virtual machine images deploy a publisher image from the gallery, and container offers publish images through Azure Container Registry that bill when pulled. The distinction matters because a SaaS offer never becomes a resource you can tag, while a managed application lands as a real resource group in your tenant.

The SaaS activation flow

SaaS offers follow a three-step activation: subscribe, configure, activate. The subscribe step creates the subscription record in your Azure billing. The configure step redirects to the publisher landing page, where you supply whatever the product needs, usually a tenant, a region, and a pricing plan. The activate step is a callback the publisher sends back to Azure confirming the subscription is live. Until that callback succeeds, the subscription stays in a pending state and the publisher is not expected to provision anything.

This matters for FinOps because a half-finished activation can leave a subscription that bills without ever being usable. The charge shows up on the Azure invoice as a marketplace line, not as a failed resource, and there is no infrastructure to tear down to make it stop. The fix is in the subscription blade, not in a resource group.

Managed apps deploy into your tenant

Azure Application offers come in two flavors. A solution template deploys resources into a resource group you own and then walks away, leaving you to operate everything. A managed application deploys into a managed resource group that lives in your subscription but is operated by the publisher. The publisher gets a managed identity on that resource group and can run operations inside it, while your team has read access by default.

The cost of the underlying resources rolls up inside that managed resource group, and the deployment is tracked under an appliance resource of type Microsoft.Solutions/applications. The publisher software charge and the consumed infrastructure are billed as separate lines, which is useful when you are trying to separate the tool cost from the cloud cost it dragged in.

Where the charges land

Marketplace purchases bill to the Azure subscription used at checkout, so they appear on the same invoice as your Azure infrastructure spend. In Enterprise Agreement and Microsoft Customer Agreement enrollments, marketplace line items are broken out in a dedicated marketplace charges section rather than mixed into the first-party service detail, and each line carries the publisher name and the offer. The practical effect is that marketplace spend is visible in the billing export but does not always map cleanly onto the Cost Management views built for native Azure services.

MACC: when a marketplace purchase counts

The Microsoft Azure Consumption Commitment, or MACC, is the spend commitment an organization makes to Azure over a term. Eligible marketplace purchases decrement that commitment just like native Azure consumption does. Eligibility is per-offer and is flagged in the storefront, so not every listing qualifies. Private offers can also be MACC-eligible, and whether they count depends on how the offer was structured at negotiation. The consumption commitment benefit documentation spells out the rules. The commitment benefit applies only to the Azure-billed portion of a marketplace transaction, not to offers that bill the customer directly outside of Azure. The check that matters is the eligibility flag on the offer page, not an assumption that everything in the marketplace counts.

Tagging and attribution

Tagging is where most marketplace attribution breaks. A SaaS offer has no underlying resource in your subscription, so there is no resource tag to carry team, environment, or cost-center metadata. Attribution for SaaS purchases has to come from the subscription it was bought on or from the invoice section mapping. Managed applications are different. The managed resource group and the appliance resource can be tagged, and those tags flow into Cost Management like any other Azure resource.

The practical rule is to drive SaaS attribution from billing metadata and managed-app attribution from tags. Relying on a single tagging policy across both will leave SaaS spend unattributed, and SaaS is usually the larger of the two categories once engineering teams start buying tools through the marketplace.

Cloud Horizons shows Azure Marketplace line items alongside native Azure, AWS, and GCP spend, so commitment burn, publisher mix, and attribution are visible in one place instead of reconciled by hand. See the features and FinOps pages for how it fits a multi-cloud FinOps practice.