Partner Resell via AWS CPPO and Azure MPO
How partners resell HailBytes ASM through cloud-marketplace private offers, with multi-year discounts, volume-band pricing, and a white-label substrate underneath the marketplace contract layer.
Companion page to the Partner Program. This page is the operational deep-dive: mechanics, money flow, pricing math, and the substrate. The Partner Program page is the higher-level audience overview.
When this page is for you
You operate a consulting firm, MSSP, MSP, or systems integrator and your customers are buying through AWS Marketplace or Azure Marketplace. You want to put HailBytes ASM on your line card without standing up a parallel billing relationship, and you want a clean margin structure that scales as your tenant count grows. If you are evaluating a 25-tenant pilot today and modeling 1,200 tenants in 18 months, the math on this page is what you should be running.
If you are an end customer (not a reseller) and you want to know how to buy directly, see how to buy. If you are an MSSP attaching white-label SAT to a compliance bundle, the closest companion page is for MSSPs; the resell mechanics on this page apply to both ASM and SAT.
Why CPPO and MPO instead of a side-channel resale agreement
The marketplace contract layer is the friction-reducer. It is doing real work for both you and your customer; reselling through it is materially cleaner than reselling around it.
For your end customer
- Single invoice through AWS or Azure; no separate vendor onboarding for HailBytes.
- Marketplace spend counts toward EDP (AWS) or MACC (Azure) commitments.
- Tax, FX, and currency handled by the cloud provider; no cross-border vendor accounts.
- Procurement-team review uses the marketplace contract layer they already approved.
For you, the partner
- Margin sits inside the private offer; no separate invoicing layer to operate.
- Payout cadence from the cloud provider is predictable (monthly arrears, 60-day terms typical).
- License-of-record stays with HailBytes; you are not the support backstop unless you choose to be.
- Multi-year commitments lock in pricing for your customer and revenue for you.
For HailBytes
- License-of-record clarity: HailBytes is the publisher of record on the marketplace.
- Tenant-level accounting through the marketplace metering hooks.
- Standard private-offer contract terms, reviewable once and reused.
For the marketplace
- AWS and Azure both treat partner-led private offers as first-class revenue.
- Marketplace co-sell motions (ACE for AWS, MS co-sell for Azure) are available on private offers; engagement gets credit on both sides.
Money flow on a partner-led private offer
The end customer pays the cloud marketplace at the resale price you set. The marketplace remits to HailBytes at the wholesale price (the HailBytes baseline, before partner margin). The partner margin is the delta; it settles to you on the marketplace's standard payout cadence. There is no separate HailBytes invoice to the end customer and no separate HailBytes invoice to the partner.
Worked example
End customer accepts a private offer at $8,800/month for a 100-tenant deployment under a 3-year commitment. The HailBytes wholesale baseline at the 100-499 band with 15% multi-year discount is $7,167/month. The partner margin is $1,633/month or about $19,600/year on this single customer. Payout follows the marketplace's standard cadence (monthly arrears in both AWS and Azure).
Numbers are illustrative for a published-tier private offer. Exact wholesale baselines vary with the volume band and commitment term and are stated in the partner-resale authorization HailBytes provides at enrollment.
AWS CPPO setup, four steps
AWS Consulting Partner Private Offer is the AWS Marketplace mechanism for partner-led resale.
Step 1 — Partner enrolls in AWS CPPO
Your firm must be an AWS Partner with CPPO enabled. Enrollment runs through the AWS Partner Central program. If you already resell other AWS Marketplace ISV products through CPPO, you are already set; the program is shared across all CPPO-authorized ISVs.
Step 2 — HailBytes grants you resale authorization
Email partners@hailbytes.com with your AWS account ID and your firm name. HailBytes adds your account to the resale-authorized list for the HailBytes ASM listing (prodview-66d5bswmbtfhs, AMI product code 1n57wg1f6735e30vj5fn420bp). Authorization is per-listing; SAT and Support Hub are separate authorizations on request.
Step 3 — You create the private offer
In AWS Marketplace Management Portal, create a Consulting Partner Private Offer for your end customer. You set the resale price, commitment term (1, 2, or 3 years), and any payment schedule. The HailBytes wholesale baseline pulls from the authorization grant; you choose the margin you want on top.
Step 4 — End customer accepts
The customer receives the private-offer link, reviews terms, and accepts inside their AWS account. Marketplace billing engages immediately; metering and tenant-level usage flow through the standard AWS Marketplace hooks. HailBytes is notified of the activation and starts the technical onboarding.
ASM listing: aws.amazon.com/marketplace/pp/prodview-66d5bswmbtfhs · AMI product code: 1n57wg1f6735e30vj5fn420bp
Azure MPO setup, four steps
Azure Multiparty Private Offer is the Azure Marketplace equivalent for partner-led resale.
Step 1 — Partner enrolls in Azure Marketplace
Your firm must be a Microsoft Cloud Partner with Marketplace Publishing or Cloud Solution Provider enabled. Enrollment runs through Partner Center; MPO is the workflow inside Partner Center for multiparty offers.
Step 2 — HailBytes grants you resale authorization
Email partners@hailbytes.com with your Microsoft Partner ID and your firm name. HailBytes adds your account to the resale-authorized list for the HailBytes ASM listing (publisher lcmcon1687976613543, offer hardened_ubuntu_with_rengine, plan standard-v2). SAT (gophish-phishing-simulator) is a separate authorization on request.
Step 3 — You create the multiparty private offer
In Partner Center, create the Multiparty Private Offer. You set the resale price, commitment term, and payment schedule. The HailBytes wholesale baseline pulls from the authorization grant.
Step 4 — End customer accepts
The customer receives the MPO link, reviews terms, and accepts inside their Azure tenant. Marketplace billing engages immediately; metering flows through the Azure Marketplace SaaS subscription hooks. HailBytes is notified and starts technical onboarding.
ASM listing: marketplace.microsoft.com/…/hardened_ubuntu_with_rengine · Publisher: lcmcon1687976613543
Multi-year commitment discounts
Discount applies on top of the volume-band pricing for committed multi-year private offers.
1-year commitment
Standard band pricing. No commitment discount. Use for pilots, PoC-to-pilot rollouts, and customers who are not yet at the multi-year procurement floor.
2-year commitment
10% off band pricing. Committed for 24 months from private-offer acceptance. Recommended floor for customers who have already validated value at the 25+ tenant scale.
3-year commitment
15% off band pricing. Committed for 36 months. The deepest discount and the cleanest revenue commitment for both partner and HailBytes; recommended for 100+ tenant rollouts with budget visibility.
Volume bands
Per-tenant wholesale pricing flattens as scale grows. Bands apply to total tenants under the partner's resale relationship, not per-customer.
| Band | Tenant count | Wholesale posture |
|---|---|---|
| Band 1 | 25–99 tenants | Entry band. Full per-tenant pricing. |
| Band 2 | 100–499 tenants | Mid band. Per-tenant cost steps down meaningfully. |
| Band 3 | 500–1,199 tenants | Scale band. Per-tenant cost compresses further. |
| Band 4 | 1,200+ tenants | Negotiated band. Custom unit pricing under a committed multi-year private offer. |
Exact band wholesale pricing is stated in the partner-resale authorization issued at enrollment. The volumes are tenant counts, not seat or asset counts.
Partner-billed ARR at scale
Illustrative ARR figures at the published bands and 3-year commitment discount. Use these to size the opportunity for a customer or for your own line-of-business plan.
| Tenant count | Band | Approximate partner-billed ARR |
|---|---|---|
| 10 tenants (sub-band entry) | Pilot, below Band 1 | ~$104,000 |
| 100 tenants | Band 2 (100–499) | ~$860,000 |
| 1,200 tenants | Band 4 (1,200+) | ~$10.1M |
| 5,000 tenants | Band 4, negotiated | ~$42M |
Figures are partner-billed (resale price at the customer), not partner margin. Margin is the delta between partner-billed and the HailBytes wholesale baseline; partners set their own margin on the private offer.
White-label substrate
Two tiers. Light branding ships in every marketplace deployment. Full white-label adds the per-tenant quota and billing reconciliation primitives a partner needs at 100+ tenants.
Light branding (included)
Available on every marketplace deployment, no platform fee. Configured per-tenant through the BrandingSettings table.
- Primary and secondary brand colors
- Logo (header) and favicon
- Brand name and product name overrides
- Email-from-name on system notifications
- Support URL and contact email per-tenant
Full white-label (platform fee tier)
Recommended at 100+ tenants. Adds per-tenant quota enforcement and partner-side billing reconciliation on top of light branding.
- ProjectQuota: per-tenant scan rate cap, asset cap, integration limits (Jira, Slack, ServiceNow, SIEM)
- /billing/projects/ endpoint: partner-side billing reconciliation, per-tenant usage rollup, exportable for partner-side invoicing
- Custom domain on the per-tenant dashboard URL
- White-label PDF report templates with partner branding
CPPO, MPO, or direct contract: when to recommend each
Recommend CPPO when
- End customer is AWS-first or AWS-only.
- Customer has remaining EDP commitment to draw down.
- Partner is already enrolled in AWS CPPO.
- Customer's procurement team prefers a single AWS invoice.
Recommend MPO when
- End customer is Azure-first or Microsoft-house.
- Customer has remaining MACC drawdown.
- Partner is a Microsoft Cloud Solution Provider or Marketplace Partner.
- Customer's procurement team prefers a single Azure invoice.
Recommend direct contract when
- Customer is multi-cloud and wants a single contract independent of cloud.
- Customer wants negotiated terms outside the marketplace contract layer.
- Customer buys through a national-account agreement, GSA schedule, or local-currency reseller (e.g. AWS Brasil, Microsoft do Brasil).
- Customer is below the marketplace minimum-deal-size floor.
See how to buy for the direct-contract path including the Brazilian and other local-currency procurement options.
Next step
If your firm wants to enroll as a resale partner, email partners@hailbytes.com with your AWS account ID or Microsoft Partner ID and the firm name. HailBytes returns a resale-authorization confirmation within five business days; private-offer setup runs in parallel with PoC scoping if a specific customer is already in motion.
If you are scoping a PoC before formalizing the resale relationship, the PoC process page documents the 14-day and 30-day options, the deliverables, the decision gates from PoC to 10-tenant to 100-tenant to 1,200-tenant rollouts, and the day-0 questions to lock down before kickoff.
Talk to the partner team