What is the difference between AWS CPPO and Azure MPO for reselling HailBytes ASM?

CPPO (AWS Consulting Partner Private Offer) and MPO (Azure Multiparty Private Offer) are the two cloud-marketplace mechanisms for partner-led resale. CPPO is used when the end customer is buying through AWS Marketplace; MPO is used when they are buying through Azure Marketplace. Both run the invoice through the cloud provider, both count toward the end customer's EDP or MACC commitment, and both give the partner a clean margin on a HailBytes-authorized private offer. The differences are operational (enrollment, partner-center workflows, payout cadence), not commercial.

How does partner margin work when reselling HailBytes ASM?

You set the resale price on the private offer; HailBytes is remitted the wholesale baseline; your margin is the difference, paid on the marketplace's standard cadence. The wholesale baseline improves with volume (more client deployments under your resale relationship) and with multi-year commitments, which add 10% (2-year) or 15% (3-year) on top. Exact wholesale rates and volume thresholds are stated in the partner-resale authorization HailBytes issues at enrollment.

What does the white-label substrate include?

Two tiers. Light branding covers colors, logo, brand name, email-from-name, and support URL via the BrandingSettings table (available on all marketplace deployments). Full white-label adds per-tenant ProjectQuota enforcement (scan rate, asset cap, integration limits) and partner-side billing reconciliation through the /billing/projects/ endpoint. Full white-label requires the platform fee tier and is the recommended posture for partners reselling to multiple clients.

When should a partner recommend CPPO versus MPO versus a direct contract?

CPPO when the end customer is AWS-first, has remaining EDP commitment to draw down, and the partner is already enrolled in CPPO. MPO when the customer is Azure-first, has MACC drawdown, and the partner is a Microsoft Cloud Solution Provider or Marketplace Partner. Direct contract when the customer is multi-cloud, wants negotiated terms outside the marketplace contract layer, or is buying through a procurement channel (national-account agreement, GSA schedule, Brazilian reseller of record) where marketplace billing is not appropriate.

For Partners

Partner Resell via AWS CPPO and Azure MPO

How partners resell HailBytes ASM through cloud-marketplace private offers, with multi-year discounts, volume discounts, and a white-label substrate underneath the marketplace contract layer.

Companion page to the Partner Program. This page is the operational deep-dive: mechanics, money flow, pricing math, and the substrate. The Partner Program page is the higher-level audience overview.

When this page is for you

You operate a consulting firm, MSSP, MSP, or systems integrator and your customers are buying through AWS Marketplace or Azure Marketplace. You want to put HailBytes ASM on your line card without standing up a parallel billing relationship, and you want a clean margin structure that scales with the number of clients you bring. Whether you are reselling to a single client today or building a book of council and enterprise accounts, the mechanics on this page are what you should be running.

If you are an end customer (not a reseller) and you want to know how to buy directly, see how to buy. If you are an MSSP attaching white-label SAT to a compliance bundle, the closest companion page is for MSSPs; the resell mechanics on this page apply to both ASM and SAT.

Why CPPO and MPO instead of a side-channel resale agreement

The marketplace contract layer is the friction-reducer. It is doing real work for both you and your customer; reselling through it is materially cleaner than reselling around it.

For your end customer

Single invoice through AWS or Azure; no separate vendor onboarding for HailBytes.
Marketplace spend counts toward EDP (AWS) or MACC (Azure) commitments.
Tax, FX, and currency handled by the cloud provider; no cross-border vendor accounts.
Procurement-team review uses the marketplace contract layer they already approved.

For you, the partner

Margin sits inside the private offer; no separate invoicing layer to operate.
Payout cadence from the cloud provider is predictable (monthly arrears, 60-day terms typical).
License-of-record stays with HailBytes; you are not the support backstop unless you choose to be.
Multi-year commitments lock in pricing for your customer and revenue for you.

For HailBytes

License-of-record clarity: HailBytes is the publisher of record on the marketplace.
Tenant-level accounting through the marketplace metering hooks.
Standard private-offer contract terms, reviewable once and reused.

For the marketplace

AWS and Azure both treat partner-led private offers as first-class revenue.
Marketplace co-sell motions (ACE for AWS, MS co-sell for Azure) are available on private offers; engagement gets credit on both sides.

Money flow on a partner-led private offer

The end customer pays the cloud marketplace at the resale price you set. The marketplace remits to HailBytes at the wholesale price (the HailBytes baseline, before partner margin). The partner margin is the delta; it settles to you on the marketplace's standard payout cadence. There is no separate HailBytes invoice to the end customer and no separate HailBytes invoice to the partner.

Worked example

End customer accepts a private offer at $8,800/month for a customer deployment under a 3-year commitment. The HailBytes wholesale baseline with the 15% multi-year discount is $7,167/month. The partner margin is $1,633/month or about $19,600/year on this single customer. Payout follows the marketplace's standard cadence (monthly arrears in both AWS and Azure).

Numbers are illustrative for a published-tier private offer. Exact wholesale baselines vary with your client volume and commitment term and are stated in the partner-resale authorization HailBytes provides at enrollment.

AWS CPPO setup, four steps

AWS Consulting Partner Private Offer is the AWS Marketplace mechanism for partner-led resale.

Step 1 — Partner enrolls in AWS CPPO

Your firm must be an AWS Partner with CPPO enabled. Enrollment runs through the AWS Partner Central program. If you already resell other AWS Marketplace ISV products through CPPO, you are already set; the program is shared across all CPPO-authorized ISVs.

Step 2 — HailBytes grants you resale authorization

Email [email protected] with your AWS account ID and your firm name. HailBytes adds your account to the resale-authorized list for the HailBytes ASM listing (prodview-66d5bswmbtfhs, AMI product code 1n57wg1f6735e30vj5fn420bp). Authorization is per-listing; SAT and Support Hub are separate authorizations on request.

Step 3 — You create the private offer

In AWS Marketplace Management Portal, create a Consulting Partner Private Offer for your end customer. You set the resale price, commitment term (1, 2, or 3 years), and any payment schedule. The HailBytes wholesale baseline pulls from the authorization grant; you choose the margin you want on top.

Step 4 — End customer accepts

The customer receives the private-offer link, reviews terms, and accepts inside their AWS account. Marketplace billing engages immediately; metering and tenant-level usage flow through the standard AWS Marketplace hooks. HailBytes is notified of the activation and starts the technical onboarding.

ASM listing: aws.amazon.com/marketplace/pp/prodview-66d5bswmbtfhs · AMI product code: 1n57wg1f6735e30vj5fn420bp

Azure MPO setup, four steps

Azure Multiparty Private Offer is the Azure Marketplace equivalent for partner-led resale.

Step 1 — Partner enrolls in Azure Marketplace

Your firm must be a Microsoft Cloud Partner with Marketplace Publishing or Cloud Solution Provider enabled. Enrollment runs through Partner Center; MPO is the workflow inside Partner Center for multiparty offers.

Step 2 — HailBytes grants you resale authorization

Email [email protected] with your Microsoft Partner ID and your firm name. HailBytes adds your account to the resale-authorized list for the HailBytes ASM listing (publisher lcmcon1687976613543, offer hardened_ubuntu_with_rengine, plan standard-v2). SAT (gophish-phishing-simulator) is a separate authorization on request.

Step 3 — You create the multiparty private offer

In Partner Center, create the Multiparty Private Offer. You set the resale price, commitment term, and payment schedule. The HailBytes wholesale baseline pulls from the authorization grant.

Step 4 — End customer accepts

The customer receives the MPO link, reviews terms, and accepts inside their Azure tenant. Marketplace billing engages immediately; metering flows through the Azure Marketplace SaaS subscription hooks. HailBytes is notified and starts technical onboarding.

ASM listing: marketplace.microsoft.com/…/hardened_ubuntu_with_rengine · Publisher: lcmcon1687976613543

Multi-year commitment discounts

Discount applies on top of standard pricing for committed multi-year private offers.

1-year commitment

Standard pricing. No commitment discount. Use for pilots, PoC-to-pilot rollouts, and customers not yet ready for a multi-year commitment.

2-year commitment

10% off standard pricing. Committed for 24 months from private-offer acceptance. A good floor once a customer has validated value and is ready to commit.

3-year commitment

15% off standard pricing. Committed for 36 months. The deepest discount and the cleanest revenue commitment for both partner and HailBytes; ideal for multi-year rollouts with budget visibility.

Volume discounts

The wholesale baseline improves as you bring more client deployments under your resale relationship. Discounts apply to your total client count, not per-customer.

Stage	Pricing posture
Getting started	Your first clients. Standard per-client wholesale pricing.
Growing your book	Per-client wholesale cost steps down as your client count grows.
High volume	Negotiated custom pricing under a committed multi-year private offer.

Exact discount thresholds and wholesale rates are stated in the partner-resale authorization issued at enrollment. Volumes are client-deployment counts, not seat or asset counts.

Sizing the opportunity

Your revenue scales with the number of clients you bring and the margin you set on each private offer.

Each client deployment carries the margin you set on top of the HailBytes wholesale baseline (see the worked example above). Stack that across your book of clients, and as your count grows the volume discount lowers the per-client wholesale cost while your margin holds or widens. For a typical consulting or MSSP book, the recurring monitoring line becomes a predictable annuity alongside your assessment and remediation services.

We will model exact figures against your pipeline at enrollment, using the wholesale baselines and discount thresholds in your resale authorization.

White-label substrate

Two tiers. Light branding ships in every marketplace deployment. Full white-label adds the per-tenant quota and billing reconciliation primitives a partner needs when reselling to multiple clients.

Light branding (included)

Available on every marketplace deployment, no platform fee. Configured per-tenant through the BrandingSettings table.

Primary and secondary brand colors
Logo (header) and favicon
Brand name and product name overrides
Email-from-name on system notifications
Support URL and contact email per-tenant

Full white-label (platform fee tier)

Recommended when reselling to multiple clients. Adds per-tenant quota enforcement and partner-side billing reconciliation on top of light branding.

ProjectQuota: per-tenant scan rate cap, asset cap, integration limits (Jira, Slack, ServiceNow, SIEM)
/billing/projects/ endpoint: partner-side billing reconciliation, per-tenant usage rollup, exportable for partner-side invoicing
Custom domain on the per-tenant dashboard URL
White-label PDF report templates with partner branding

CPPO, MPO, or direct contract: when to recommend each

Recommend CPPO when

End customer is AWS-first or AWS-only.
Customer has remaining EDP commitment to draw down.
Partner is already enrolled in AWS CPPO.
Customer's procurement team prefers a single AWS invoice.

Recommend MPO when

End customer is Azure-first or Microsoft-house.
Customer has remaining MACC drawdown.
Partner is a Microsoft Cloud Solution Provider or Marketplace Partner.
Customer's procurement team prefers a single Azure invoice.

Recommend direct contract when

Customer is multi-cloud and wants a single contract independent of cloud.
Customer wants negotiated terms outside the marketplace contract layer.
Customer buys through a national-account agreement, GSA schedule, or local-currency reseller (e.g. AWS Brasil, Microsoft do Brasil).
Customer is below the marketplace minimum-deal-size floor.

See how to buy for the direct-contract path including the Brazilian and other local-currency procurement options.

Next step

If your firm wants to enroll as a resale partner, email [email protected] with your AWS account ID or Microsoft Partner ID and the firm name. HailBytes returns a resale-authorization confirmation within five business days; private-offer setup runs in parallel with PoC scoping if a specific customer is already in motion.

Prefer a structured intake? The partner enrollment form captures your AWS account ID or Azure tenant ID and routes straight to the partner team, with email to [email protected] remaining available as an alternative.

Start Partner Enrollment →

If you are scoping a PoC before formalizing the resale relationship, the PoC process page documents the 14-day and 30-day options, the deliverables, the decision gates from PoC to pilot to full rollout, and the day-0 questions to lock down before kickoff.

Talk to the partner team