Choosing a Microsoft CSP partner: who you buy from, what they can access, how you leave

Buying Microsoft licences through the Cloud Solution Provider programme puts a partner between you and Microsoft. The partner invoices you: buy through a CSP under the Microsoft Customer Agreement and “you receive your invoice from the partner”, in the words of Microsoft’s MCA FAQ. The partner takes your support calls, because CSP customers cannot raise support requests with Microsoft themselves. And to raise those requests for you, it needs admin roles on your tenant. Choosing a CSP partner is therefore a decision about who sits in that position, and on what terms, as well as a decision about price.

Price has a documented shape too. Most of Microsoft’s CSP price lists carry two figures: a list price, “the price the partner is billed”, and an estimated retail price (ERP), also called the Microsoft suggested retail price, which Microsoft describes as the estimated market value of the products “if a customer were to purchase the products directly from Microsoft”. Microsoft calls the gap between the two partner margin, and says margins “can vary” from segment to segment.

So, a disclosure before the checklist. Veratas is a Microsoft CSP, and we earn a margin on licences bought through us: Microsoft 365 E5 pays us more than E3. Our commitment on price is that licences bought through Veratas cost no more than the same licence bought directly from Microsoft online, and that where deal size, term or promotions allow, we pass agreed margin discounts on to you. That is our commitment, not a Microsoft rule: Microsoft describes ERP only as its estimate of the direct price. Every check below is taken from Microsoft’s own documentation, so you can put it to any partner, us included.

This article starts after the agreement decision. If you are still choosing between CSP, an Enterprise Agreement and buying direct under a Microsoft Customer Agreement, read Anuj’s comparison of CSP, the Enterprise Agreement and the MCA first.

Direct-bill partner or indirect reseller: who you are really buying from

Microsoft’s CSP overview is plain about it: “There are two sales models for CSP authorization”, direct-bill and indirect. People say CSP reseller for both, but the difference decides who can act for you, so it is the first thing to establish.

A direct-bill partner buys from Microsoft and sells to you itself. The model “requires partners to sell to, bill, manage, and support their customers autonomously”, and the bar is high: at least USD 1 million of CSP revenue in the trailing 12 months, at least 12 months as an indirect reseller first, a Solutions Partner designation, a passing capabilities assessment and a paid Microsoft partner support plan, among other requirements. It does not buy a closer line into Microsoft, though: “Direct-bill status doesn’t guarantee that the partner has an assigned Microsoft account manager.”

An indirect reseller buys through a distributor (Microsoft’s older term is indirect provider, and many of its pages still use it). Microsoft’s indirect reseller guidance sets out the split: “The Distributor handles billing with Microsoft; the reseller owns the customer relationship.” The reseller “can’t transact in CSP without an active Distributor relationship”, and that chain decides who can do what for you:

Each row is Microsoft’s. Indirect resellers “can’t open support requests in the Azure portal on customer’s behalf”, even with a support contract (reporting problems for a customer). They “can’t attest on behalf of their customers” (confirming the MCA) and “aren’t able to add new customers” (adding a customer). For transfers they need their distributor, “the billing owner of the subscription”.

None of this makes an indirect reseller the wrong choice. It does make the distributor part of your support path and your exit path, so you should know its name. Ask which model the partner is in, which distributor sits behind it if it is indirect, and who will be partner of record on each of your subscriptions. For our part, Veratas is a CSP indirect reseller. We buy through a distributor, and we name the distributor for your region, with its support escalation path, on the quote and in the written proposal before you sign.

If you operate in more than one country, ask about region as well. Microsoft authorises CSP partners by region, and its regional authorisation rules are strict: “Partners can only create customers for countries/regions in their region”, and your market “depends on the country or region set in the tenant”. The regions are not continents. Europe is one region, covering the UK, the EU and the EFTA countries. The United States and Canada are separate regions; Australia, India and New Zealand are each their own; and the Middle East sits inside a region Microsoft calls “Middle East, Central Europe, and Eastern Europe”. To sell in a region, a partner needs “at least one CSP tenant associated with a legal business address” there (indirect provider FAQ). That rule decides which partner can sell to each of your tenants. Where your people sit is a separate matter: Microsoft’s licence terms let you assign Microsoft 365 licences to users “anywhere in the world”, except in Cuba, Iran, North Korea, Sudan and Syria. We transact as a CSP in the United States and in India, through a distributor in each, and before you sign we tell you whether each of your tenants sits in one of those regions. Where one does not, we can still advise on its licensing and run managed services for it, and we coordinate the purchase through an authorised partner in that region.

Who answers when something breaks

Under CSP, the partner is your support desk for Microsoft. Microsoft’s guidance to partners on customer support is direct: “CSP customers can’t create support requests themselves. They must contact you for support.” The exception is narrow. Microsoft 365’s support page says you need at least one subscription bought through Microsoft to reach Microsoft support yourself.

Microsoft defines what the partner owes you in a few lines. It must receive your requests, diagnose them and “Resolve issues within scope of the baseline support boundaries”, handing Microsoft the categories Microsoft lists as its own to fix, such as unavailable services and bugs. It may resell support from another company or “Outsource all or part of the support structure”, and “You can charge for all or part of the support”. Direct-bill partners own the relationship end to end; indirect resellers “should work with their indirect providers to support customers.” Subscription notices come through the partner too, because Microsoft “doesn’t send communications directly to your customers related to their subscriptions”, although it may still contact you about service incidents.

One line in that guidance works in your favour. Microsoft tells partners to “tell customers the types of support you provide, the service hours, contact method”, and the price where support is charged. Ask for those four things in writing and compare partners on them.

Here are ours, so the comparison has a starting point. Included in the licence price: subscription provisioning, renewal and seat governance, billing queries, and escalating faults in Microsoft’s services to Microsoft. You reach us through our support portal or by email, Monday to Friday, 08:30 to 17:30 local business time, with 24/7 escalation through our distributor for Severity A, tenant-wide outages. Charged separately, through a managed-service retainer or an agreed time-and-materials rate: day-to-day administration, such as onboarding and offboarding users, Conditional Access changes, Intune policy and individual user troubleshooting.

When the partner does need Microsoft, it raises a support request for you through Partner Center (an indirect reseller goes through its distributor), and that needs access. Microsoft’s lockout guidance says the “Partner needs an active GDAP relationship with the Service Support Administrator role”. If you remove the partner’s admin roles, it “can’t open a service request at Microsoft on their behalf” until the relationship is re-established (admin privileges). What it costs when this route fails is covered in Anuj’s comparison.

What admin access a CSP partner should hold under GDAP

Before GDAP, partners were granted delegated admin privileges (DAP), which Microsoft describes as including Global Administrator permissions. Microsoft retired DAP, and gives its reason in the GDAP migration FAQ: “DAP is susceptible to security attacks due to its longevity and high privileged access.” Since 10 October 2023, it “is no longer available with reseller relationships”.

Its replacement, granular delegated admin privileges (GDAP), gives a partner named roles for a fixed period, and “Customers must explicitly grant the least-privileged access to their partners” (GDAP introduction). The rules in Microsoft’s GDAP FAQ are worth knowing before you accept a request:

• Nothing is permanent. “The maximum duration of a GDAP relationship is two years.”
• It can roll on without you. A relationship can auto-extend by six months at a time, and “Customer consent isn’t required” for a partner to switch that on. A relationship that includes Global Administrator cannot auto-extend.
• Access and purchasing are separate. An expired GDAP changes nothing about your subscriptions, and removing it does not end the reseller relationship: “Partners can still purchase products for the customer”. It works the other way too. Ending the reseller relationship “has no impact on existing granular delegated admin privileges (GDAP)”, Microsoft’s page on connecting with customers says, so GDAP has to be ended separately.

If a partner creates your tenant, it does not start from nothing. Unless it unticks the Default GDAP option when adding you as a customer, Microsoft “no longer grants DAP for new customer creation and instead grants Default GDAP”. The table in the same FAQ lists eleven Microsoft Entra roles for direct-bill partners and distributors, the partners Microsoft lets add new customers, and nine for indirect resellers. Global Administrator is not among them. Privileged Role Administrator is, and Microsoft describes it as a role that “Can manage role assignments in Microsoft Entra, and all aspects of Privileged Identity Management.” The lockout guidance lists GDAP with “either Global Administrator or Privileged Role Administrator” as enough for a partner to promote a customer user to Global Administrator. As an indirect reseller we do not create customers ourselves; our distributor does, and we ask it not to set up Default GDAP for us. We then send only the scoped request described in our position below, or none at all for a licensing-only client.

None of that says how any given partner uses its roles. The question is which roles your partner holds, until when, and why. Microsoft’s role guidance maps tasks to the least-privileged role: Service Support Administrator to submit support requests, and License Administrator, which “Can assign, remove, and update license assignments”. On Global Administrator, the GDAP FAQ‘s guidance is narrow: when it is “necessary to work around listed known issues”, partners should “work with your customer to request a time-bound Global Administrator role”.

To see what any partner holds, go to the Microsoft 365 admin center, Settings > Partner relationships. The Entra admin center, PowerShell and Graph will not show it: Microsoft says customers “can’t find the partners who are assigned a Microsoft Entra role” that way. One of Microsoft’s own customer pages, on reviewing partner admin privileges, still describes DAP and a quarterly DAP review. Treat that as a reason to look, not as evidence that your partner holds Global Administrator.

Removing a partner’s roles is yours to do at any time, and it does less than it appears to. Removing admin roles “doesn’t remove the partner relationship”, Microsoft’s partner management page says; the partner can still work with you as a reseller, and to stop that you “contact your partner to end the relationship”. Azure, as the next section shows, is separate again.

What we find when a tenant changes partner

When we onboard a Microsoft 365 or Azure estate, whether for managed services, a security review or licensing advice, the Partner relationships page is rarely clean. Ending a contract with a partner does not end its technical access, and we find leftover access from one former partner, sometimes from three. Three issues come up most often.

MLT_ relationships from 2023. In its own transition from DAP, Microsoft created GDAP relationships named MLT_ followed by fragments of the partner and customer tenant IDs, with eight roles (nine from July 2023, when Global Reader was added). It removed DAP 30 days later and suppressed the “emails that would normally go to customers”, so you may never have been told. Each relationship “lasts for one year”, and it expired then unless the partner or the customer had turned on auto-extend. The ones we find have usually expired, but in our experience the entries stay on the list until an admin clears them. Do not assume yours has expired: check the status and end date of each one.

High-privilege GDAP left running by the outgoing partner. We often find the outgoing partner’s GDAP still active months after the contract ended, either with an end date set well beyond it or with auto-extend on, which rolls it forward six months at a time. Auto-extend never applies to a relationship that includes Global Administrator, so those run to their end date instead, which can still be long after you have moved.

Orphaned Azure Owner assignments. When a direct-bill partner or a distributor provisions an Azure plan subscription, its Admin Agents group “is automatically assigned the Owner role” on it (admin privileges), and the assignment appears in the subscription’s Access control (IAM) as a foreign principal. Ending GDAP does not touch it: in the GDAP FAQ’s words, “removing GDAP doesn’t remove RBAC”. To stop the partner managing the subscription, “the customer must remove the role assignment”.

One recent onboarding shows how these stack up. A 320-seat UK professional services firm had just left an indirect reseller. We audited Settings > Partner relationships and Access control (IAM) on its Azure subscriptions, and found three entries that should not have been there. The outgoing CSP still held active GDAP with Global Administrator and Privileged Role Administrator, set to expire four months after its contract ended. A previous IT provider, gone for two years, still had an expired MLT_ entry. And in the production Azure subscription, a foreign principal belonging to that same former provider still held Owner. On a shared screen with the client’s own Global Administrator, we ended the outgoing CSP’s GDAP relationship, cleared the old MLT_ entry, removed the foreign principal’s Owner assignment under Subscriptions > Access control (IAM) > Role assignments, and reviewed Enterprise applications in Entra ID, where we revoked two multi-tenant diagnostic apps the former provider had registered. The audit and clean-up took 35 minutes of the onboarding call. The GDAP removal then took roughly 45 minutes to take effect and end existing sessions. That is what we observed on that tenant, not a Microsoft figure.

Run the same check before you sign with a new partner, us included, and again when you leave one.

Your tenant stays yours

A CSP relationship changes who bills you. It should not change who owns the tenant, and the point where that can blur is when the tenant is created. If your partner creates it in Partner Center, Microsoft’s instruction at the confirmation screen is to “save the customer credentials so you can email them to the customer”. And Microsoft’s Entra role guidance notes that, by default, whoever signs up for a Microsoft cloud service is assigned the Global Administrator role. Ask who created your tenant, which account those first credentials belong to, and who holds it today. When our distributor creates a new tenant for one of our clients, we hold a handover call within 24 hours. The client sets up its own named admin account and two break-glass accounts, then resets or deletes the first admin account on its own screen (in our experience that account carries Global Administrator). We then confirm in writing that Veratas holds no accounts or passwords in the client’s directory, and that any access we keep runs only through GDAP relationships the client can see and remove.

Then keep your own Global Administrators, in the right number. Partner Center’s lockout checklist says each tenant should have “at least two Global Admin accounts with distinct credentials and MFA methods.” Entra’s best practice is to give the role to “fewer than five people in your organization”. The reason is practical: for any scenario involving your tenant, the same lockout guidance says “Microsoft must work directly with a Global Administrator on the tenant where access issues are occurring”.

Ask, too, how the partner protects its own tenant, since that is where its access to yours begins. Under Microsoft’s partner security requirements, since 1 October 2025 every CSP partner must “Enable multifactor authentication (MFA) for all administrative users in the CSP tenant”, name a security contact and, except indirect resellers, respond to security alerts within 24 hours. Microsoft checks existing partners against these each year.

The commercial terms: what the partner sets and what Microsoft fixes

Before a partner can order anything for you, “the customer must accept the Microsoft Customer Agreement” (CSP overview). Microsoft’s confirmation guidance allows two routes: you accept it yourself in the Microsoft 365 admin center, or the partner attests that you did, after which your primary contact “receives an automated email notice within 30 minutes of attestation”. Since 7 October 2025, partners relying only on an attestation made before 1 April 2023 have been blocked from new purchases, quantity changes, term or billing changes and upgrades until they re-attest or you accept the agreement directly. Ask how your agreement was accepted, when, and by whom.

The terms themselves come from Microsoft’s new commerce experience, which Anuj covers in depth in the agreement comparison linked above. Four points matter when you compare partners:

• Term lengths vary by product. New commerce supports “monthly, annual, or three-year terms for many subscriptions”, not all, and three-year terms exist only for some SKUs.
• Microsoft’s price to the partner is fixed for the term. “Subscription price changes take effect at renewal, upgrade, or term conversion.” That rule governs what Microsoft bills the partner, so ask whether the partner holds its own price to you for the same term.
• Reductions have a short window. Seats can be added at any time but reduced “only within the first seven days of when the licenses were added”, and cancellation with a prorated refund is possible “within the first seven days (168 hours) of any term” (subscription management).
• After that, the partner owes Microsoft regardless. It is “billed for the full term even if the customer stops paying”. For customers considered a payment risk, Microsoft’s cancellation policy suggests a monthly term “that allows for subscription cancellation at the end of any month”.

Then ask where the partner’s own price sits against Microsoft’s estimated retail price for each line on the quote, and what happens to it at renewal. The margin between list price and ERP is why the disclosure above matters, and why the checklist below rests on Microsoft’s documentation rather than on any partner’s advice, ours included.

Our own answer: we hold the agreed per-seat price for the whole term of each monthly or annual subscription. It changes only at renewal, and then only if Microsoft changes its list price or currency tables, or your seat count crosses a tiered discount threshold. The one exception is a change in statutory tax.

Azure through a CSP partner: what you can see and who can act

Cost Management for CSP Azure “is natively available only for subscriptions that are on the Azure plan”, and to enable it the partner must confirm your Microsoft Customer Agreement and move you onto that plan (Cost Management for partners). Ask which plan your subscriptions are on.

Even then, your view depends on the partner: the cost visibility policy “is disabled by default for all subscription users” unless the partner enables it, and in the indirect model it “must get enabled by the provider”, meaning the distributor rather than the reseller. When it is on, costs show at pay-as-you-go retail rates, and “Costs shown don’t include any discounts or credits that the partner may have”, so the figures your team sees may not match your invoice. Ask whether the policy will be on from day one, and who will switch it on. For our Azure plan clients, we ask our distributor to switch it on at provisioning, and we check that pay-as-you-go costs show in the client’s own Azure portal before onboarding is complete.

Two more points to settle. Azure support requests on your behalf can be opened only by a direct-bill partner or a distributor, and in the indirect model the default Owner assignment on a new subscription also goes to the distributor. Where neither we nor the distributor manage the workload, we walk the client through Access control (IAM) so it can review or remove Owner assignments it does not need. And if you change partner, “Historical costs before the transfer to the new partner don’t move”, so agree how you will keep your cost history before you need it. Azure pricing, partner earned credit and reservations under CSP are covered in Anuj’s comparison.

How you leave: moving subscriptions to another CSP partner

Leaving is where the outgoing partner’s cooperation matters, because it can block the transfer of your existing subscriptions. Microsoft’s transfer guidance sets out the sequence:

1. You tell your current partner you intend to move.
2. You sign the Microsoft Customer Agreement with the new partner and accept its relationship request.
3. The new partner creates the transfer: “Customers don’t initiate the transfer process; instead, their target partner does.”
4. Your current partner approves it. Most transfers finish in under an hour, but some “may take up to 72 hours”.

Step four is the one to understand before you sign anything. “Partners are under no obligation to approve or send transfer requests.” Microsoft “will not override a CSP subscription transfer without the source partner’s approval”, does not mediate disputes between partners, and its partner support “can’t make the source partner accept”. If the outgoing partner declines or ignores the request, it “expires after 30 days”.

Transfers cover licence-based subscriptions, Azure plan subscriptions, reservations and savings plans, among others. Microsoft re-creates a transferred licence subscription under the new partner “at the price of the original subscription” (the price Microsoft bills the new partner), with a new subscription ID, and “There’s no new cancellation window because transferred subscriptions aren’t considered new subscription terms.” One transfer carries at most 25 licence-based line items per billing plan, so a larger estate may need several.

Access does not move with billing. When Azure plan subscriptions change partner, billing goes to the new one, but “Your previous partner keeps their Azure RBAC access” until you remove it, and the new partner gets none automatically (Azure plan transfers between partners). GDAP does not end with the transfer either, as the GDAP section above showed. Both have to be removed on purpose.

Business Central needs checking before you sign. Microsoft’s main transfer page says “business central items can’t be transferred using this transfer capability”, and its page on marketplace and software transfers says “Partners can’t transfer 3PP Business Central at this time”. Neither page describes another route. The practical one is a cutover at renewal: set up the relationship with the new partner before the renewal date, have the outgoing subscription explicitly set to cancel at term end, and have the new subscription live, with licences assigned, before the old one ends. Each step matters more since 4 May 2026, when Microsoft discontinued “the free grace period for accessing services on nonrenewed subscriptions” that are eligible for extended service terms. At term end, such a subscription renews, moves to month-to-month extended service terms at the monthly rate plus 3% (23% where no monthly plan exists), or is cancelled. Switching off auto-renew is not enough on its own: Microsoft moves an eligible subscription with auto-renew off but no cancellation set into extended service terms. Left to renew or roll on, the old subscription keeps billing; ended before the new one is live, it leaves your users without a licence. Your environments and data stay where they are: Microsoft’s reseller guidance places “Business Central environments in your customers’ tenants”, so only the licence subscription changes. Check your Business Central renewal date before you serve notice. If you are choosing a Business Central implementation partner rather than a licensing one, that is a different checklist: see choosing a Business Central partner.

You do not have to move everything at once. Microsoft’s multi-partner support “supports scenarios where a customer wants to work with more than one partner”; Microsoft’s own example is one partner for Office 365 and another for Azure. Adding a partner does not change your existing subscriptions or their partner of record.

Badges and the partner directory

Microsoft’s route to a partner is its partner directory, where badges for a partner’s earned Solutions Partner designations appear on its business profile. A designation needs a partner capability score “of at least 70 points” out of 100 on one of Microsoft’s six solution paths, with every metric above zero. The score covers performance, skilling and customer success, through net customer adds, certifications, usage growth and deployments. Since August 2026 the customer-facing badges carry three names, AI Business Solutions, Cloud & AI Platforms and Security, but partners still earn them “through the same six solution paths, with the same partner capability score metrics” (August 2026 announcements). And “Microsoft no longer offers Silver and gold memberships” (programme introduction), so a partner still describing itself as Gold is out of date.

A badge shows scale and capability in a solution area. It does not show how a partner handles access to your tenant, what its support covers or what it will do when you leave. Use the directory to check that a partner’s claims are honest, not as a substitute for the terms in this article. A Microsoft CSP provider worth shortlisting should be able to show you both.

Our position on access, exit and price

Microsoft’s documentation sets the limits. These are the positions we take within them, and the commitments we make so that you can hold us to them.

A licensing-only partner needs no admin roles. Once the reseller relationship exists, a partner can buy, change quantities, cancel and renew licence-based subscriptions and see invoices without a single Entra role on your tenant. Microsoft’s GDAP FAQ asks whether a partner can “continue to transact for a customer after removing all GDAP relationship with the customer”, and answers “Yes.” There is one caveat: a partner needs GDAP “to manage their Azure subscriptions”, and without it, it can’t assign licences to your users or log support tickets for you. So for licensing-only clients we request no GDAP roles at all or, if you want us to read your service health and handle Microsoft support escalations for you, a custom request limited to Service Support Administrator and Directory Readers for 180 days.

Privileged Role Administrator should never be held by default. Microsoft’s Entra role reference says the role “grants the ability to manage assignments for all Microsoft Entra roles including the Global Administrator role”, and that its holders “can grant themselves or others additional privilege”. The lockout guidance quoted above treats it as enough to promote a user to Global Administrator. In our assessment, that puts Global Administrator within reach of whoever holds the role, a partner technician included, and a licensing relationship has no use for it. Default GDAP and the 2023 Microsoft-led relationships both include it, so ask any partner holding it to name the task that needs it, and remove it if they cannot.

Managed-service access should follow the statement of work. Where a partner also runs your estate, we think its roles should map to the tasks in the statement of work, such as Exchange, SharePoint, Intune, Security or Helpdesk Administrator, assigned to dedicated security groups in the partner’s tenant and activated just in time through Privileged Identity Management (PIM) rather than held standing. A role nobody can tie to a line in the contract should not be there.

Write the exit into the contract. Microsoft will not make an outgoing partner approve a transfer, Azure role assignments stay behind until you remove them, and GDAP outlives the reseller relationship. Without a contractual deadline, an incumbent can let your request lapse after 30 days and leave you choosing between staying and paying twice for parallel licences until the term ends. We think every buyer should write a transfer and exit cooperation clause into the CSP agreement, saying at least this:

1. Provided undisputed invoices up to the transfer date are settled, the partner approves a valid Partner Center transfer request within a fixed period, such as 5 business days.
2. For Azure plan subscriptions, the partner completes the billing transfer and removes its foreign principal role assignments within the same period.
3. When the transfer completes, the partner ends all its remaining GDAP relationships with you.

We hold ourselves to the same standard. Veratas commits that a valid transfer request for your subscriptions will be approved within 5 business days of the request reaching us, through our distributor, which approves transfers as billing owner, provided there is no undisputed overdue balance on your account. Within 24 hours of the transfer completing, we will end our GDAP relationships with you, unless a separate managed-service agreement with us needs specific roles to stay, and help you check that any distributor Owner assignments you no longer need are removed from the transferred Azure subscriptions. Both commitments are in our standard CSP schedule. If a client wants to leave, we would rather give them a reason to stay than hold their transfer request until it lapses.

Price is not where the real risk sits. CSP is often sold as a per-seat price comparison, and a small saving per seat is easy to see on a quote. The larger exposure is the one that does not appear there: standing Privileged Role Administrator access to your tenant, and renewals that run without anyone on your side watching them. We would rather you paid a fair price to a partner whose access you can see and whose exit terms you have in writing.

The CSP partner checklist

Thirteen questions, each tied to a Microsoft rule above. Ask for the answers in writing, so you can compare partners line by line.

1. Are you a direct-bill partner or an indirect reseller, and if indirect, which distributor?
2. If we operate in more than one country: which CSP regions are you authorised in, and do they cover the country set in each of our tenants?
3. Who will be partner of record on each of our subscriptions?
4. What support do you provide: types, hours, contact method and price?
5. Who files our Microsoft support requests, and does your GDAP relationship carry Service Support Administrator? Who opens Azure support requests?
6. Which GDAP roles do you hold on our tenant, when do they end, and is auto-extend on?
7. Do you hold Privileged Role Administrator or Global Administrator, and why?
8. Who created our tenant, and who holds its Global Administrator accounts today?
9. How and when was our Microsoft Customer Agreement accepted, and by whom?
10. What term, billing plan and renewal date is each subscription on, what is your price against Microsoft’s estimated retail price, and will you hold it until renewal?
11. Will the Azure cost visibility policy be on for our subscriptions from day one, and who will switch it on?
12. If we leave, will you approve the transfer request within a stated number of days, remove your Azure role assignments and end your GDAP relationships? How would our Business Central licences move?
13. Which Solutions Partner designations do you hold? We will check them in Microsoft’s partner directory.

Every one of these applies to us too: put them to Veratas as you would to anyone, and note that we have answered several of them for ourselves above. If you want an independent view of what you already hold first, our free Microsoft CSP licensing review looks at your current Microsoft 365, Dynamics and Azure licences, with no fee and no obligation. If the question is who runs the estate rather than who supplies it, that is a managed services conversation. Either way, talk to our team. What a licence review should find, and what ours involves, is set out in Microsoft licence review: what it should find.

Frequently asked questions

What does a CSP partner do? It sells you Microsoft cloud subscriptions, invoices you, handles purchases and cancellations, and is your first line of support, because CSP customers cannot open support requests with Microsoft themselves. It can buy and renew for you without any admin roles on your tenant, but to raise support requests for you or manage your Azure subscriptions it needs delegated admin roles through GDAP, which you grant and can remove.

What is the difference between a direct-bill partner and an indirect reseller? A direct-bill partner buys from Microsoft and bills and supports you itself. An indirect reseller buys through a distributor, which handles billing with Microsoft. Indirect resellers cannot open Azure support requests, attest your Microsoft Customer Agreement or approve a transfer; their distributor does those.

How do I check what admin access my CSP partner has? In the Microsoft 365 admin center, under Settings > Partner relationships, including any MLT_ relationships left from Microsoft’s 2023 transition. Microsoft says partner role assignments cannot be found through the Entra admin center, PowerShell or Graph. Then check Access control (IAM) on each Azure subscription for the partner’s Owner assignment, which shows as a foreign principal: removing GDAP does not remove it, and ending the reseller relationship does not end GDAP.

Can I switch CSP partner mid-term? Yes, if both partners agree. The new partner starts the transfer and your current partner must approve it; Microsoft will not override a refusal, and an unanswered request expires after 30 days, which is why we recommend a transfer clause in your contract. Microsoft carries the original subscription price across to the new partner, a transfer can take up to 72 hours, and there is no new cancellation window. Azure role assignments stay with the old partner until you remove them, and Business Central, which Microsoft’s main transfer page excludes, is best moved at renewal.

Can I use more than one CSP partner? Yes. Microsoft’s multi-partner support lets a customer work with more than one partner, for example one for Office 365 and another for Azure. Adding a partner does not change your existing subscriptions or their partner of record.

Manish Kumar

Senior Business Intelligence Architect with 22 years of experience designing enterprise analytics and data platforms. Focus areas include Power BI, real-time analytics, and large-scale BI architecture across the Microsoft data stack.