Partner Resell via AWS CPPO and Azure MPO
How partners resell HailBytes ASM through cloud-marketplace private offers, with annual commitment discounts up to 40%, volume discounts, and your own brand on the product and its reports underneath the marketplace contract layer.
Companion page to the Partner Program. This page is the operational deep-dive: mechanics, money flow, pricing math, and the branding and quota controls. The Partner Program page is the higher-level audience overview.
When this page is for you
You operate a consulting firm, MSSP, MSP, or systems integrator and your customers are buying through AWS Marketplace or Azure Marketplace. You want to put HailBytes ASM on your line card without standing up a parallel billing relationship, and you want a clean margin structure that scales with the number of clients you bring. Whether you are reselling to a single client today or building a book of council and enterprise accounts, the mechanics on this page are what you should be running.
If you are an end customer (not a reseller) and you want to know how to buy directly, see how to buy. If you are an MSSP attaching white-label SAT to a compliance bundle, the closest companion page is for MSSPs; the resell mechanics on this page apply to both ASM and SAT.
Why CPPO and MPO instead of a side-channel resale agreement
The marketplace contract layer is the friction-reducer. It is doing real work for both you and your customer; reselling through it is materially cleaner than reselling around it.
For your end customer
- Single invoice through AWS or Azure; no separate vendor onboarding for HailBytes.
- Marketplace spend counts toward EDP (AWS) or MACC (Azure) commitments.
- Tax, FX, and currency handled by the cloud provider; no cross-border vendor accounts.
- Procurement-team review uses the marketplace contract layer they already approved.
For you, the partner
- Margin sits inside the private offer; no separate invoicing layer to operate.
- Payout cadence from the cloud provider is predictable (monthly arrears, 60-day terms typical).
- License-of-record stays with HailBytes; you are not the support backstop unless you choose to be.
- Annual and multi-year commitments lock in pricing for your customer and revenue for you.
For HailBytes
- License-of-record clarity: HailBytes is the publisher of record on the marketplace.
- Tenant-level accounting through the marketplace metering hooks.
- Standard private-offer contract terms, reviewable once and reused.
For the marketplace
- AWS and Azure both treat partner-led private offers as first-class revenue.
- Marketplace co-sell motions (ACE for AWS, MS co-sell for Azure) are available on private offers; engagement gets credit on both sides.
Money flow on a partner-led private offer
The end customer pays the cloud marketplace at the resale price you set. The marketplace remits to HailBytes at the wholesale price (the HailBytes baseline, before partner margin). The partner margin is the delta; it settles to you on the marketplace's standard payout cadence. There is no separate HailBytes invoice to the end customer and no separate HailBytes invoice to the partner.
Worked example
End customer accepts a private offer for a 32 vCPU deployment on a 3-year commitment at the published 3-year price: $3,360/month, or $40,380/year — 40% off the $5,610/month list rate. Partner margin is up to 20% of that post-discount net, so $672/month, about $8,064/year on this single customer; HailBytes is remitted the remaining $2,688/month. Margin scales with what the customer spends, so a customer running two 32 vCPU deployments carries twice this. Worth knowing before you lead with the deepest term: because margin comes off the net rather than off list, the same shape bought at list ($5,610/month) carries $1,120/month of margin for you — a commitment discount reduces your margin as well as our revenue. Payout follows the marketplace's standard cadence (monthly arrears in both AWS and Azure).
Numbers are illustrative for a published-tier private offer. Exact wholesale baselines vary with your client volume and commitment term and are stated in the partner-resale authorization HailBytes provides at enrollment.
AWS CPPO setup, four steps
AWS Consulting Partner Private Offer is the AWS Marketplace mechanism for partner-led resale.
Step 1 — Partner enrolls in AWS CPPO
Your firm must be an AWS Partner with CPPO enabled. Enrollment runs through the AWS Partner Central program. If you already resell other AWS Marketplace ISV products through CPPO, you are already set; the program is shared across all CPPO-authorized ISVs.
Step 2 — HailBytes grants you resale authorization
Email [email protected] with your AWS account ID and your firm name. HailBytes adds your account to the resale-authorized list for the HailBytes ASM listing (prodview-66d5bswmbtfhs, AMI product code 1n57wg1f6735e30vj5fn420bp). Authorization is per-listing; SAT and Support Hub are separate authorizations on request.
Step 3 — You create the private offer
In AWS Marketplace Management Portal, create a Consulting Partner Private Offer for your end customer. You set the resale price, commitment term (1, 2, or 3 years), and any payment schedule. The HailBytes wholesale baseline pulls from the authorization grant; you choose the margin you want on top.
Step 4 — End customer accepts
The customer receives the private-offer link, reviews terms, and accepts inside their AWS account. Marketplace billing engages immediately; metering and tenant-level usage flow through the standard AWS Marketplace hooks. HailBytes is notified of the activation and starts the technical onboarding.
ASM listing: aws.amazon.com/marketplace/pp/prodview-66d5bswmbtfhs · AMI product code: 1n57wg1f6735e30vj5fn420bp
Azure MPO setup, four steps
Azure Multiparty Private Offer is the Azure Marketplace equivalent for partner-led resale.
Step 1 — Partner enrolls in Azure Marketplace
Your firm must be a Microsoft Cloud Partner with Marketplace Publishing or Cloud Solution Provider enabled. Enrollment runs through Partner Center; MPO is the workflow inside Partner Center for multiparty offers.
Step 2 — HailBytes grants you resale authorization
Email [email protected] with your Microsoft Partner ID and your firm name. HailBytes adds your account to the resale-authorized list for the HailBytes ASM listing (publisher lcmcon1687976613543, offer hardened_ubuntu_with_rengine, plan standard-v2). SAT (gophish-phishing-simulator) is a separate authorization on request.
Step 3 — You create the multiparty private offer
In Partner Center, create the Multiparty Private Offer. You set the resale price, commitment term, and payment schedule. The HailBytes wholesale baseline pulls from the authorization grant.
Step 4 — End customer accepts
The customer receives the MPO link, reviews terms, and accepts inside their Azure tenant. Marketplace billing engages immediately; metering flows through the Azure Marketplace SaaS subscription hooks. HailBytes is notified and starts technical onboarding.
ASM listing: marketplace.microsoft.com/…/hardened_ubuntu_with_rengine · Publisher: lcmcon1687976613543
Annual commitment discounts
Discount applies off list price for committed annual private offers of 1, 2, or 3 years. Save up to 40% with annual commitment.
1-year commitment
30% off list. Paid annually upfront, committed for 12 months — the entry tier on the ladder. At the 8 vCPU entry size that is $11,760/year against a $16,800 list. On-demand hourly and month-to-month stay at list with no commitment discount; use those for pilots and PoC-to-pilot rollouts.
2-year commitment
35% off list. Committed for 24 months from private-offer acceptance — $10,920/year at 8 vCPU. A good floor once a customer has validated value and is ready to commit.
3-year commitment
40% off list. Committed for 36 months — $10,080/year at 8 vCPU. The deepest discount and the cleanest revenue commitment for both partner and HailBytes; ideal for multi-year rollouts with budget visibility.
A publisher cannot discount a published marketplace metered rate, so these are delivered as private offers — AWS CPPO or Azure MPO. Full size × term pricing is on the pricing page.
Volume discounts
The wholesale baseline improves as you bring more client deployments under your resale relationship. Discounts apply to your total client count, not per-customer.
| Stage | Pricing posture |
|---|---|
| Getting started | Your first clients. Standard per-client wholesale pricing. |
| Growing your book | Per-client wholesale cost steps down as your client count grows. |
| High volume | Negotiated custom pricing under a committed multi-year private offer. |
Exact discount thresholds and wholesale rates are stated in the partner-resale authorization issued at enrollment. Volumes are client-deployment counts, not seat or asset counts.
How band transitions work: the price on a private offer is fixed for its term once the customer accepts it (per AWS and Azure marketplace rules), so crossing into a higher volume band does not retroactively reprice offers already accepted. A better wholesale baseline applies to the new authorizations and offers you issue after reaching the band — and either side can request a good-faith renegotiation of the baseline as your transacted volume crosses the next threshold.
Sizing the opportunity
Your revenue scales with the number of clients you bring and the margin you set on each private offer.
Each client deployment carries the margin you set on top of the HailBytes wholesale baseline (see the worked example above). Stack that across your book of clients, and as your count grows the volume discount lowers the per-client wholesale cost while your margin holds or widens. For a typical consulting or MSSP book, the recurring monitoring line becomes a predictable annuity alongside your assessment and remediation services.
We will model exact figures against your pipeline at enrollment, using the wholesale baselines and discount thresholds in your resale authorization.
White-labeling under your own brand
Two tiers, and one boundary worth being precise about: white-label here means your brand replaces HailBytes’ on the product and its reports. It does not mean a different brand per client.
Branding (included)
Available on every marketplace deployment. One instance-wide configuration, applied to everything on that deployment.
- Primary and secondary brand colors
- Logo (header) and favicon
- Brand name and product name overrides
- Email-from-name on system notifications
- Support URL and contact email
- Custom domain on the dashboard URL
- PDF report templates carrying your branding, with the HailBytes credit line switched off
Operational controls
What you add when you are running deployments for a book of clients rather than one.
- ProjectQuota: per-Project scan rate cap, asset cap, integration limits (Jira, Slack, ServiceNow, SIEM)
- /billing/projects/ endpoint: scan-time usage rollup per Project, exportable for your own invoicing. Operator-only — it is not access-gated per client, so anyone who can reach it sees every Project’s name and spend. Do not give a client a login to it.
- Per-client sending identity and hostname on SAT organizations
What white-labeling does not do, so you do not promise it: a different brand per client, a separate identity provider per client, and client self-service administration are all out of reach on a shared deployment — branding and SSO configuration are instance-wide, with one configuration per identity provider per instance, and there is no organization-scoped admin role. A client that requires any of those needs its own deployment, at $16,800/year in software fees for the 8 vCPU entry size. For ASM that is the shape regardless: one deployment per client, because recurring scheduled scans across multiple client Projects on one instance are not supported today and operator roles are instance-wide.
CPPO, MPO, or direct contract: when to recommend each
Recommend CPPO when
- End customer is AWS-first or AWS-only.
- Customer has remaining EDP commitment to draw down.
- Partner is already enrolled in AWS CPPO.
- Customer's procurement team prefers a single AWS invoice.
Recommend MPO when
- End customer is Azure-first or Microsoft-house.
- Customer has remaining MACC drawdown.
- Partner is a Microsoft Cloud Solution Provider or Marketplace Partner.
- Customer's procurement team prefers a single Azure invoice.
Recommend direct contract when
- Customer is multi-cloud and wants a single contract independent of cloud.
- Customer wants negotiated terms outside the marketplace contract layer.
- Customer buys through a national-account agreement, GSA schedule, or local-currency reseller (e.g. AWS Brasil, Microsoft do Brasil).
- Customer is below the marketplace minimum-deal-size floor.
See how to buy for the direct-contract path including the Brazilian and other local-currency procurement options.
Next step
If your firm wants to enroll as a resale partner, email [email protected] with your AWS account ID or Microsoft Partner ID and the firm name. HailBytes returns a resale-authorization confirmation within five business days; private-offer setup runs in parallel with PoC scoping if a specific customer is already in motion.
Prefer a structured intake? The partner enrollment form captures your AWS account ID or Azure tenant ID and routes straight to the partner team, with email to [email protected] remaining available as an alternative.
Start Partner Enrollment →If you are scoping a PoC before formalizing the resale relationship, the PoC process page documents the 14-day and 30-day options, the deliverables, the decision gates from PoC to pilot to full rollout, and the day-0 questions to lock down before kickoff.
Talk to the partner team