Microsoft Marketplace Partner Digest
In this edition of the Microsoft Marketplace Partner Digest, you'll find essential announcements, events, and key updates designed to drive your business forward, accelerate deal closures, and maximize your Marketplace success. Partner Center announcements As we kick off the new fiscal year, we're building upon a quarter that delivered valuable enhancements for both Marketplace partners and customers. Weâve focused on expanding partner-led growth across regions, simplifying SaaS transactions, and helping you improve co-sell outcomes. đ Multiparty private offers expand across EMEA and APAC On May 27, Microsoft Marketplace expanded multiparty private offers to 30 countries in Europe, with availability in Australia, Japan, and South Africa coming July 15. Read the blog to discover how we are enabling new opportunities for channel-led growth through Marketplace. Why it matters Software companies gain more opportunities to reach new customers and drive growth without adding operational complexity. Channel partners differentiate their offerings with vetted software solutions while maintaining customer relationships. Recommended action Microsoftâs Jason Rook breaks down six practical steps to activate your channel strategy through Microsoft Marketplace, helping software companies recruit, enable, and scale partner-led growth. đGet the playbook đ Resale enabled offers support expands to New Zealand Microsoft continues expanding channel-led sales opportunities by making resale enabled offers available through Microsoft Marketplace to customers in New Zealand as of May 26. Why it matters Channel partners can create and manage offers directly, without relying on software companies to build bespoke private offers. For software companies, resale enabled offers provide a scalable way to grow through trusted channel partners and expand into new markets. đ Learn more đ Custom contract lengths As of July 6, custom contract lengths for private offers are generally available. Partners can now create private offers with custom contract lengths of up to 10 years in Microsoft Marketplace. Why it matters Flexibility to better meet customer requirements Ability to configure contract durations from 1 to 120 months Define non-standard contract lengths, like 18 months or 45 months Support for both SaaS and professional services transactions đ Read the announcement ⥠Auto activation for SaaS offers On May 18, Microsoft released the optional auto activation for SaaS offers, streamlining customer's Marketplace purchase and onboarding experience. Whatâs new Billing and subscription activation can now begin immediately when a customer completes a purchase Partners receive a real-time webhook signal to trigger onboarding Available for both public and private offers Default behavior For existing plans auto activation is off, unless you enable it When creating new plans auto activation is on, by default, unless you disable it Why it matters Reduces friction between purchase and onboarding Improves revenue predictability with immediate billing Enables a faster, more seamless customer experience Recommended action Evaluate your SaaS offers and enable auto activation where it aligns with your onboarding model. Make sure your sales and customer guidance reflect the updated experience. đ Learn more đ Improve referral quality to accelerate co-sell deals Microsoft has updated how inbound co-sell referrals are reviewed and processed to improve speed and alignment with Microsoft account teams. Whatâs changing All referrals are now automatically checked for completeness and quality at submission. To avoid delays, ensure every referral includes: Solution area / play Estimated deal value Estimated close date (valid future date) Clear customer need and business context Customer contact (or consent to share later) Why it matters Submitting complete referrals helps you: Get faster seller engagement Reduce rework and follow-ups Improve acceptance rates Move deals forward more predictably Recommended action Audit your referral submission process and ensure these five fields are consistently included across all deals. đ Learn more about managing co-sell opportunities â ď¸ Review: Ensure the right contacts receive important partner communications Now is a great time to take care of digital housekeeping. Microsoft is reminding partners to review assigned Partner Center roles and email configurations to avoid missing critical notifications and account updates. Why it matters Having assigned roles like global admin or billing admin does not guarantee email delivery. If accounts arenât configured correctly, you and your team may miss time-sensitive notifications. Missing communications can result in missed compliance deadlines or delayed actions that may impact your business. Recommended actions Verify your primary contact email is up to date Ensure role-based accounts can receive emails Add Microsoft system emails as safe senders Review role guidance on Microsoft Learn ⨠Bonus: Sign up for the monthly Microsoft AI Cloud Partner Program newsletter to stay informed of updates, incentives, and partner opportunities. Itâs an easy way to get partner news delivered directly to your inbox.⯠Events Recent events Marketplace as a FinOps platform Explore how Microsoft Marketplace helps simplify purchasing, centralize billing, and better align software investments to optimize cloud spending. As organizations scale cloud and AI investments, managing spend across tools and vendors becomes more complex. Tune in to learn practical ways to better understand the ROI of your organizationâs cloud and AI investments. You will walk away with actionable insights to use Microsoft Marketplace as part of your FinOps strategy đ˝ď¸ Watch the recording The Marketplace playbook for channel-led sales Get step-by-step guidance and go-to-market resources to help you recruit and activate partners for channel-led sales through Microsoft Marketplace. ThroughâŻresale enabled offersâŻandâŻmultiparty private offers, software companies can empower partners to sell on their behalf to drive scale, reach new markets, and unlock new co-sell opportunities. In markets where both resale enabled offers and multiparty private offers are available, software companies can also scale through distributors, who can activate their broader channel networks. đ˝ď¸ Watch the recording Multicurrency transactions explained As Marketplace adoption continues to grow more partners are navigating sales that involve multiple currencies, local customer invoicing, and evolving seller of record responsibilities. Understanding how currency exchanges impact private offers, partner payments, and customer billing is critical to successfully managing Marketplace transactions across global geographies. đ˝ď¸ Watch the recording Upcoming events Channel growth in Australia âWednesday, July 15 at 9:30 AEST Microsoft Marketplace provides several ways for partners to collaborate and grow through the channel. With multiparty private offers launching in Australia on July 16, alongside resale enabled offers, this expansion helps partners strengthen customer relationships, fuel more partner-to-partner opportunities, simplify transactions, and find new growth opportunities. Leave with practical guidance on how these capabilities work together and how to put them into action. đ Save to your calendar MCAPS Start for Partners đ Wednesday, July 22 from 7:00 â 11:00 am PDT MCAPS Start for Partners gives software companies an early look at Microsoftâs FY27 priorities, investments, and growth opportunities. Learn how AI innovation and agentic applications are creating new customer demand, discover marketplace and co-sell opportunities to expand reach, and explore strategies to modernize, differentiate, and grow your business in the year ahead. đ Learn more and register today đ Closing thoughts The last quarter delivered meaningful platform enhancements to make Microsoft Marketplace easier to scale, faster for customers to discover solutions and transact, and more effective for partners to manage business. đ Take the next step Explore new regions for multiparty private offers and resale enabled offers Review your strategy for activation of customer SaaS subscriptions Improve your co-sell submission quality Small changes in these areas can have a big impact on your pipeline, conversion, and overall Marketplace success.Design observability for AI apps and agents selling through Microsoft Marketplace
In the last post, API resilience and reliability patterns for AI apps and agents, we focused on what happens when AI systems encounter failureâand how resilient execution paths keep that failure contained. Timeouts fire with intent. Retries stay bounded. Circuit breakers provide overload protection. When resilience is designed well, your system continues to function even as conditions change, forming the foundation of AI reliability engineering. You can always get curated step-by-step guidance through building, publishing and selling apps for Marketplace through App Advisor. This post is part of a series on building and publishing well-architected AI apps and agents in Microsoft Marketplace. The series focuses on AI apps and agents that are architected, hosted, and operated on Azure, with guidance aligned to building and selling solutions through Microsoft Marketplace. Observability for AI systems AI apps and agents are shifting traditional observability, which was designed for systems based on simple assumptions, where requests followed linear paths and workloads behaved predictably. Execution in AI systems consumes tokens at a highly variable rate rather than fixed compute units. Requests unfold across multiple reasoning steps. Agents perform work that spans APIs, models, retrieval layers, and applications. A single interaction may pause, branch, retry, or exit early depending on inferred intent, context, and constraints. Instead of asking whether services are running, observability for AI systems asks: what is the system doing right nowâand why? Is an agent spending its time reasoning, waiting on dependencies, retrying tool calls, or exiting early due to enforced limits? Is cost increasing because value is increasing, or because execution paths are expanding without progress? AI observability requirements shift the focus in the following subtle, but critical ways: From resource availability to workflow state From performance metrics to signals From incidents to patterns Core observability dimensions for AI apps and agents Once observability shifts toward understanding behavior, clarity comes from tracking state across the agents in the workflow. For AI apps and agents, observable indicators, such as those detailed below, show how work unfolds and changes during real usageâespecially in trials and early adoption: Execution flow shows how a request moves through agents, tools, and workflows. This highlights where execution progresses smoothly, where it slows, and where it concludes early. This makes agent outcomes explainable and keeps behavior consistent across tenants. Cost and token behavior reveals how execution translates into consumption. Token usage per request, per agent step, and per retry shows where value is being delivered and where execution paths expand without proportional benefit. This insight connects runtime behavior directly to Marketplace billing expectations and evaluations. Latency and wait states distinguish active processing from time spent waiting on dependencies. Seeing where time is consumed helps explain slow experiences and guides decisions about optimization, caching, or resilience improvements. Failure classification provides structure when systems degrade and supports effective AI incident management. Separating tool failures from planning failures, and transient issues from terminal exits, keeps investigations focused and prevents protective behavior from being misread as instability. Tenantâlevel patterns surface how behavior repeats at scale. Uneven load, and recurring degradation often appear first during trials and shape the customer's perception. Together, these dimensions turn telemetry into understandingâsupporting clearer conversations, faster triage, and predictable execution as usage grows. Why observability matters By this point in the journey, your AI app or agent has implemented bounded execution paths, cost controls, and quality of service safeguards. As a result, failure degrades gracefully instead of spreading. These resilience techniques determine how your solution behaves under pressure. The data gathered from observability platforms like Application Insights and Azure Monitor explains why it behaves that way. For AI and agentic systems, infrastructure health alone rarely answers the questions that matter. Services can be up, CPUs can be idle, and queues can look healthy while agents loop inefficiently, retries quietly expand cost, or workflows exit early without delivering value. From the customerâs perspective, the experience feels inconsistent even though the platform appears stable. AI app observability closes this gap by revealing system behavior rather than system status. It shows how requests move, where work concentrates, and how constraints shape outcomes. At Marketplace scale, these patterns repeat across tenants and trials. What appears once during an evaluation often appears again as adoption grows. Observability connects runtime behavior back to the design choices introduced in earlier posts: Usageâbased billing introduced variability in consumption Performance optimization introduced tradeoffs among latency, quality, and cost Resilience patterns introduced controlled failure and bounded execution Observability allows you to explain outcomes during trials, validate assumptions as usage grows, and support post-launch AI operations confidence across customers and environments. Without this visibility, teams react to symptoms. With it, they recognize patterns. From execution paths to behavioral signals Observability begins at the same place resilience beginsâAPI boundaries. These boundaries define where responsibility shifts and where behavior becomes visible. Observability focuses on signals that explain decisions made by the system as it executes instead of relying on raw logs that describe isolated events. Every resilience mechanism emits behavioral signals. Viewed together, these signals provide far more value than logs alone. Logs answer whether something happened. Behavioral signals explain why it happened and how the system responded. Circuit breakers change state as load builds and recedes. Retry loops show whether failures resolve quickly or exhaust their limits. Timeout enforcement reveals where dependencies slow execution. Fallback paths and early terminations show how the system protects itself while preserving outcomes for customers. This perspective matters most for agents. Agent execution unfolds as a series of choicesâplan, call a tool, retry, exit earlyârather than a single requestâresponse cycle, which requires monitoring AI agent behavior to remain understandable and consistent at scale. Observability that tracks these decisions makes agent behavior understandable, consistent, and defensible as usage grows across customer tenants. Observability at the agent layer As AI systems become more agentâdriven, observability needs to move closer to where decisions are made. Agents introduce variability by design. They plan, adapt, and choose workflow paths dynamically. Without firstâclass visibility into that behavior, execution can appear unpredictable even when the underlying system is healthy. Observability at the agent layer acts as the feedback loop that keeps execution safely bounded. It shows how agents use the freedom you give themâand where that freedom begins to stretch into inefficiency. Observability follows how the agent did its job instead of treating the agentâs interaction as a single outcome. Several indicators help make agent behavior understandable. Step count per request reveals how much reasoning effort a prompt requires. Planning iterations show whether an agent converges quickly or cycles through alternatives. Tool invocation frequency highlights when agents rely heavily on external systems. Early exits compared to full completion explain whether limits and fallbacks activate as designed. Taken together, these indicators help distinguish healthy exploration from inefficient reasoning and degraded execution. An agent exploring briefly before converging adds value. An agent looping through tools without progress signals pressure, uncertainty, or dependency issues. This distinction reinforces a core principle of agentic systems: models reason probabilistically, adapting to context as it changes. Your system observes deterministicallyâmeasuring execution, enforcing boundaries, and clarifying outcomes. When those roles stay separate and wellâinstrumented, agent behavior becomes transparent, predictable, and ready for Marketplace scale. Observability across environments The type of Marketplace offer you choose shapes what observability customers expect and how responsibility is shared. For SaaS offers, publishers typically own endâtoâend execution. Observability centers on agent behavior, workflow completion, token usage, latency, and dependency impact across tenants. Publishers rely on consistent signalsâoften surfaced through tools like Azure Monitor, Application Insights, and Microsoft AI Foundryâto explain how requests behave as scale and load increase. For containerâbased offers and Azure Managed Applications, observability expectations are more distributed. Publishers expose clear execution outcomes, limits, and failure signals at application boundaries. Customers, in turn, observe infrastructure health, scaling behavior, and downstream systems within their own environments. This separation ensures each party has visibility into what they control without creating ambiguity. Learn more about Choosing your marketplace offer type for AI Apps and agents. Execution behavior differs across environments for predictable reasons. Scale increases, tenant mix broadens, and external dependencies behave differently under real load. What must stay consistent is how behavior is interpreted. Signal definitions, thresholds, and failure classification should mean the same thing in Dev, Stage, and Prod. Learn more about designing a reliable environment strategy for Microsoft Marketplace AI apps and agents. Staging environments are where this consistency is validated. Observing retries, timeouts, and graceful degradation before production prepares you for Marketplace evaluations, which often resemble production conditions. Observability gaps tend to appear first during customer evaluationâwhen clarity matters most. Publisher and customer visibility boundaries Purpose: Parallel Post #13 responsibility clarity, now for observability As observability matures across environments, clarity around responsibility becomes essential. For Marketplace solutions, trust grows when publishers and customers each see what they ownâand understand where that visibility ends. Publishers are responsible for instrumenting execution paths end to end. That means making workflows traceable, limits visible, and failure modes explainable. Observability should surface behaviorâhow requests progressed, where execution concluded, and whyârather than exposing raw internal errors that require insider knowledge to interpret. Customers focus their observability on what they control. This includes monitoring downstream systems, infrastructure behavior, and environmentâlevel alerts within their own estate. When visibility aligns with ownership, teams can act quickly and decisively. Exposing too much internal detail can overwhelm customers and blur accountability. Observing too little behavior creates friction, especially when issues cross boundaries and lack context. Clear visibility enables faster triage, sharper ownership boundaries, and fewer escalations rooted in ambiguity. Observability as an enabler for scale, billing, and trust From a customerâs perspective, observability answers two fundamental questions: Can I understand what happened? and Can I trust this at scale? When the answer to both is clear, observability becomes part of the value your Marketplace offering delivers. When system behavior is visible and explainable, customers gain confidence that adoption and growth will remain predictable. Observability directly supports usageâbased billing by tying execution behavior to measured consumption. Clear visibility into token usage, retries, and execution paths helps validate how usage is calculated and supports transparent billing conversations. It also enables ongoing performance tuning and caching strategies by showing where latency accumulates, where work repeats, and where optimization delivers measurable impact. Observability reinforces confidence in resilience mechanisms, confirming that limits, fallbacks, and degradation paths activate as designed under realâworld conditions. Beyond validation, observability creates a continuous feedback loop. Execution data informs pricing adjustments, guides changes to limits, and helps refine default configurations as customer behavior evolves. Whatâs next in the journey With execution behavior observable and explainable, the focus shifts to how AI systems are operated safely as change accelerates. The upcoming posts will discuss deployment strategies, CI/CD pipelines for agents, and progressive rollouts build on this foundationâensuring AI apps evolve confidently as usage and expectations grow. Key Resources See curated, step-by-step guidance to help you build, publish, or sell your app or agent (no matter where you start) in App Advisor Quick-Start Development Toolkit can connect you with code templates for AI solution patterns Microsoft AI Envisioning Day Events How to build and publish AI apps and agents for Microsoft Marketplace Get over $126K USD in benefits and technical consultations to help you replicate and publish your app with ISV SuccessDesigning a reliable environment strategy for Microsoft Marketplace AI apps and agents
Technical guidance for software companies Delivering an AI app or agent through Microsoft Marketplace requires more than strong model performance or a wellâdesigned user flow. Once your solution is published, both you and your customers must be able to update, test, validate, and promote changes without compromising production stability. A structured environment strategyâDev, Stage, and Productionâis the architectural mechanism that makes this possible. This post provides a technical blueprint for how software companies and Microsoft Marketplace customers should design, operate, and maintain environment separation for AI apps and agents. It focuses on safe iteration, version control, quality gates, reproducible deployments, and the shared responsibility model that spans publisher and customer tenants. You can always get a curated step-by-step guidance through building, publishing and selling apps for Marketplace through App Advisor. This post is part of aâŻseriesâŻon building and publishing well-architected AI apps and agents in Microsoft Marketplace.âŻThe series focuses on AI apps and agents that are architected, hosted, and operated on Azure, with guidance aligned to building and selling solutions through Microsoft Marketplace. Why environment strategy is a core architectural requirement Environment separation is not just a DevOps workflow. It is an architectural control that ensures your AI system evolves safely, predictably, and traceably across its lifecycle. This is particularly important for Marketplace solutions because your changes impact not just your own environment, but every tenant where the solution runs. AIâdriven systems behave differently from traditional software: Prompts evolve and drift through iterative improvements. Model versions shift, sometimes silently, affecting output behavior. Tools and external dependencies introduce new boundary conditions. Retrieval sources change over time, producing different Retrieval Augmented Generation (RAG) contexts. Agent reasoning is probabilistic and can vary across environments. Without explicit boundaries, an update that behaves as expected in Dev may regress in Stage or introduce unpredictable behavior in Production. Marketplace elevates these risks because customers rely on your solution to operate within enterprise constraints and support AI scalability for enterprise. A wellâdesigned environment strategy answers the fundamental operational question: How does this solution change safely over time? Publisher-managed environment (tenant) Software companies publishing to Marketplace must maintain a clear threeâtier environment strategy. Each environment serves a distinct purpose and enforces different controls. Development environment: Iterate freely, without customer impact In Dev, engineers modify prompts, adjust orchestration logic, integrate new tools, and test updated model versions. This environment must support: Rapid prompt iteration with strict versioning, never editing in place. Model pinning, ensuring inference uses a declared version. Isolated test data, preventing contamination of production RAG contexts. Featureâflagâdriven experimentation, enabling controlled testing. Staging environment: Validate behavior before promotion Stage is where quality gates activate. All changesâincluding prompt updates, model upgrades, new tools, and logic changesâmust pass structured validation before they can be promoted. This environment enforces: Integration testing that supports AI app performance optimization Acceptance criteria Consistency and performance baselines Safety evaluation and limits enforcement Production environment: Serve customers with reliability and rollback readiness Solutions running in production environments, regardless of whether they are publisher hosted or deployed into a customer's tenant must provide: Stable, predictable behavior, supported by deliberate AI workload capacity planning Strict separation from test data sources Clearly defined rollback paths Auditability for all environmentâspecific configurations This model highlights the core environments required for Marketplace readiness; in practice, publishers may introduce additional environments such as integration, testing, or preproduction depending on their delivery pipeline. The customer tenant deployment model: Deploying safely across customer environments Once a Marketplace customer purchases and deploys your AI app or agent, they must be able to deploy and maintain your solution across all their environments without reverse engineering your architecture. A strong offer must provide: Repeatable deployments across all heterogeneous environments. Predictable configuration separation, including identity, data sources, and policy boundaries. Customerâcontrolled promotion workflowsâupdates should never be forced. No required reâcreation of environments for each new version. Publishers should design deployment artifacts such that customers do not have to manually reâestablish trust boundaries, identity settings, or configuration details each time the publisher releases a solution update. Plan for AIâspecific environment challenges AI systems introduce behavioral variances that traditional microservices do not. Your environment strategy must explicitly account for them. Prompt drift Prompts that behave well in one environment may respond differently in another due to: Different user inputs, where production prompts encounter broader and less predictable queries than test environments Variation in RAG contexts, driven by differences in indexed content, freshness, and data access Model behavior shifts under scale, including concurrency effects and token pressure, which also affects cost and requires attention to cost optimization for AI apps Tool availability differences, where agents may have access to different tools or permissions across environments This requires explicit prompt versioning and environment-based promotion. Model version mismatches If one environment uses a different model version or even a different checkpoint, behavior divergence will appear immediately. Publishers should account for the following model management best practices: Model version pinning per environment Clear promotion paths for model updates RAG context variation Different environments may retrieve different documents unless seeded on purpose. Publishers should ensure their solutions avoid: Test data appearing in production environments Production data leaking into non-production environments Cross contamination of customer data in multi-tenant SaaS solutions Make sure your solution accounts for stale-data and real-time data. Agent variability Agents exhibit stochastic reasoning paths, which becomes more pronounced when scaling AI agents. Environments must enforce: Controlled tool access Reasoning step boundaries Consistent evaluation against expected patterns Publisherâcustomer boundary: Shared responsibilities Marketplace AI solutions span publisher and customer tenants, which means environment strategy is jointly owned. Each side has well-defined responsibilities. Publisher responsibilities Publishers should: Design an environment model that is reproducible inside customer tenants. Provide clear documentation for environment-specific configuration. Ensure updates are promotable, not disruptive, by default. Capture environmentâspecific logs, traces, and evaluation signals to support debugging, audits, and incident response. Customer responsibilities Customers should: Maintain environment separation using their governance practices. Validate updates in staging before deploying them in production. Treat environment strategy as part of their operational contract with the publisher. Environment strategies support Marketplace readiness A wellâdefined environment model is a Marketplace accelerator. It improves: Onboarding Customers adopt faster when: Deployments are predictable Configurations are well scoped Updates have controlled impact Long-term operations Strong environment strategy reduces: Regression risk Customer support escalations Operational instability Solutions that support clear environment promotion paths have higher retention and fewer incidents. Whatâs next in the journey The next architectural decision after environment separation is identity flow across these environments and across tenant boundaries, especially for AI agents acting on behalf of users. The followâup post will explore tenant linking, OAuth consent patterns, and identityâplane boundaries in Marketplace AI architectures. See the next post in the series: Designing Tenant Linking to Scale Microsoft Marketplace AI Apps. Key Resources See curated, step-by-step guidance to help you build, publish, or sell your app or agent (no matter where you start) in App Advisor Quick-Start Development Toolkit can connect you with code templates for AI solution patterns Microsoft AI Envisioning Day Events How to build and publish AI apps and agents for Microsoft Marketplace Get over $126K USD in benefits and technical consultations to help you replicate and publish your app with ISV SuccessQuality and evaluation framework for successful AI apps and agents in Microsoft Marketplace
Why quality in AI is different â and why it matters for Marketplace Traditional software quality spans many dimensions â from performance and reliability to correctness and fault tolerance â but once those characteristics are specified and validated, system behavior is generally stable and repeatable. Quality is assessed through correctness, reliability, performance, and adherence to specifications. AI apps and agents change this equation. Their behavior is inherently non-deterministic and contextâdependent. The same prompt can produce different responses depending on model version, retrieval context, prior interactions, or environmental conditions, which is why non-deterministic AI testing is required to evaluate it reliably. For agentic systems, quality also depends on reasoning paths, tool selection, and how decisions unfold across multiple steps â not just on the final output. This means an AI app can appear functional while still falling short on quality: producing responses that are inconsistent, misleading, misaligned with intent, or unsafe in edge cases. Without a structured evaluation framework, these gaps often surface only in production â in customer environments, after trust has already been extended. For Microsoft Marketplace, this distinction matters. Buyers expect AI apps and agents to behave predictably, operate within clear boundaries, and remain fit for purpose as they scale. AI quality evaluation turns those expectations into something observable â and that visibility is what determines Marketplace readiness. You can always get a curated step-by-step guidance through building, publishing and selling apps for Marketplace through App Advisor. This post is part of aâŻseriesâŻon building and publishing well-architected AI apps and agents in Microsoft Marketplace.âŻThe series focuses on AI apps and agents that are architected, hosted, and operated on Azure, with guidance aligned to building and selling solutions through Microsoft Marketplace. How quality measurement shapes Marketplace readiness AI apps and agents that can demonstrate quality â with documented evaluation frameworks, defined release criteria, and evidence of ongoing measurement â are easier to evaluate, trust, and adopt. Quality evidence reduces friction during Marketplace review, clarifies expectations during customer onboarding, and supports long-term confidence in production. When quality is visible and traceable, the conversation shifts from "does this work?" to "how do we scale it?" â which is exactly where publishers want to be. Publishers who treat quality as a first-class discipline build the foundation for safe iteration, customer retention, and sustainable growth through Microsoft Marketplace. That foundation is built through the decisions, frameworks, and evaluation practices established long before a solution reaches review. What "quality" means for AI apps and agents Quality for AI apps and agents is not a single metric â it spans interconnected dimensions that together define whether a system is doing what it was built to do, for the people it was built to serve. The HAX Design Library â Microsoft's collection of human-AI interaction design patterns â offers practical guidance for each one. These dimensions must be defined before evaluation begins. You can only measure what you have first described. Accuracy and relevance â does the output reflect the right answer, grounded in the right context? HAX patterns Make clear what the system can do (G1) and notify users when the AI is uncertain (G10) help publishers design systems where accuracy is visible and outputs are understood in the right context â not treated as universally authoritative. Safety and alignment â does the output stay within intended use, without harmful, biased, or policy-violating content? HAX patterns Mitigate social biases (G6) and Support efficient correction (G9) help ensure outputs stay within acceptable boundaries â and that users can identify and address issues before they cause downstream harm. Consistency and reliability â does the system behave predictably across users, sessions, and environments? HAX patterns Remember recent interactions (G12) and notify users about changes (G18) keep behavior coherent within sessions and ensure updates to the model or prompts are never silently introduced. Fitness for purpose â does the system do what it was designed to do, for the people it was designed to serve, in the conditions it will actually operate in? HAX patterns make clear how well the system can do what it does (G2) and Act on the user's context and goals (G4) ensure the system responds to what users actually need â not just what they literally typed. These dimensions work together â and gaps in any one of them will surface in production, often in ways that are difficult to trace without a deliberate evaluation framework. Designing an evaluation framework before you ship Evaluation frameworks should be built alongside the solution. At the end, gaps are harder and costlier to close. The discipline mirrors the design-in approach that applies to security and governance: decisions made early shape what is measurable, what is improvable, and what is ready to ship. A well-structured evaluation framework defines five things: What to measure â the quality dimensions that matter most for this solution and its intended use cases. For AI apps and agents, this typically includes task adherence, response coherence, groundedness, and safety â alongside the fitness-for-purpose dimensions defined in the previous section. How to measure it â the methods, tools, and benchmarks used to assess quality consistently. Effective evaluation combines AI-assisted evaluators (which use a model as a judge to score outputs), rule-based evaluators (which apply deterministic logic), and human review for edge cases and safety-relevant responses that automated methods cannot fully capture. Who evaluates â the right combination of automated metrics, human review, and structured customer feedback. No single method is sufficient; the framework defines how each is applied and when human judgment takes precedence. When to evaluate â at defined milestones: during development to establish a baseline, pre-release to validate against acceptance thresholds, at rollout to catch regression, and continuously in production to detect drift as models, prompts, and data evolve. What triggers re-evaluation â model updates, prompt changes, new data sources, tool additions, or meaningful shifts in customer usage patterns. Re-evaluation should be a scheduled and triggered discipline, not an ad hoc response to visible failures. The framework becomes a shared artifact â used by the publisher to release safely, and by customers to understand what quality commitments they are adopting when they deploy the solution in their environment. Evaluate your AI agents - Microsoft Foundry | Microsoft Learn Evaluation methods for AI apps and agents Quality must be assessed across complementary AI evaluation methods â each designed to surface a different category of risk, at a different stage of the solution lifecycle. Automated metric evaluation â evaluators assess agent responses against defined criteria at scale. Some use AI models as judges to score outputs like task adherence, coherence, and groundedness; others apply deterministic rules or text similarity algorithms. Automated evaluation is most effective when acceptance thresholds are defined upfront â for example, a minimum task adherence pass rate before a release proceeds. Safety evaluation â a dedicated evaluation category that identifies potential content risks, policy violations, and harmful outputs in generated responses. Safety evaluators should run alongside quality evaluators, not as a separate afterthought. Human-in-the-loop evaluation â structured expert review of edge cases, borderline outputs, and safety-relevant responses that automated metrics cannot fully capture. Human judgment remains essential for interpreting context, intent, and impact. AI agent red-teaming and adversarial testing â probing the system with challenging, unexpected, or intentionally misused inputs (including prompt injection attempts and tool misuse) to surface failure modes before customers encounter them. Microsoft provides dedicated AI red teaming guidance for agent-based systems. Customer feedback loops â structured collection of real-world signals from users interacting with the system in production. Production feedback closes the gap between what was tested and what customers actually experience. Each method has a distinct role. The evaluation framework defines when and how each is applied â and which results are required before a release proceeds, a change is accepted, or a capability is expanded. Defining release criteria and ongoing quality gates Quality evaluation only drives improvement when it is connected to clear release criteria, often enforced through an LLMOps quality gate. In an LLMOps model, those criteria are automated gates embedded directly into the CI/CD pipeline, applied consistently at every stage of the release cycle. In continuous integration (CI), automated evaluations run with every change â whether that change is a prompt update, a model version, a new tool, or a data source modification. CI gates catch regressions early, before they reach customers, by validating outputs against predefined quality thresholds for task adherence, coherence, groundedness, and safety. In continuous deployment (CD), quality gates determine whether a build is eligible to proceed. Release criteria should define: Minimum acceptable thresholds for each quality dimension â a release does not proceed until those thresholds are met Known failure modes that block release outright versus those that are tracked, monitored, and accepted within defined risk tolerances Deployment constraints â conditions under which a release is paused, rolled back, or progressively expanded to a subset of users before full rollout Ongoing evaluation must be scheduled and triggered. As models, prompts, tools, and customer usage patterns evolve, the baseline shifts. LLMOps treats re-evaluation as a continuous discipline: run evaluations, identify weak areas, adjust, and re-evaluate before changes propagate. This connects directly to governance. Quality evidence â the record of what was measured, when, and against what criteria â is part of the audit trail that makes AI behavior accountable, explainable, and trustworthy over time. For more on the governance foundation this builds on, see Governing AI apps and agents for Marketplace readiness. Quality across the publisher-customer boundary Clear quality ownership reduces friction at onboarding, builds confidence during operation, and protects both parties when behavior deviates. In the Marketplace context, quality is a shared responsibility â but the boundaries are distinct. Publishers are responsible for: Designing and running the evaluation framework during development and release Defining quality dimensions and thresholds that reflect the solution's intended use Providing customers with transparency into what quality means for this solution â without exposing proprietary prompts or internal logic Customers are responsible for: Validating that the solution performs appropriately in their specific environment, with their data and their users Configuring feedback and monitoring mechanisms that surface quality signals in their tenant Treating quality evaluation as a shared ongoing responsibility, not a one-time publisher guarantee When both sides understand their role, quality stops being a handoff and becomes a foundation â one that supports adoption, sustains trust, and enables both parties to respond confidently when behavior shifts. What's next in the journey A strong quality framework sets the baseline â but keeping that quality visible as solutions scale is its own discipline. The next posts in this series explore what comes after the framework is in place: API resilience, performance optimization, and operational observability for AI apps and agents running in production environments. See the next post in the series: Designing a reliable environment strategy for Microsoft Marketplace AI apps and agents | Microsoft Community Hub. Key resources See curated, step-by-step guidance to help you build, publish, or sell your app or agent (no matter where you start) in App Advisor Quick-Start Development Toolkit can connect you with code templates for AI solution patterns Microsoft AI Envisioning Day Events How to build and publish AI apps and agents for Microsoft Marketplace Get over $126K USD in benefits and technical consultations to help you replicate and publish your app with ISV SuccessGoverning AI apps and agents for Marketplace
Governing AI apps and agents Governance is what turns powerful AI functionality into a solution that enterprises can confidently adopt, operate, and scaleâan essential part of AI governance for agents. It establishes clear responsibility for actions taken by the system, defines explicit boundaries for acceptable behavior, and creates mechanisms to review, explain, and correct outcomes over time. Without this structure, AI systems can become difficult to manage as they grow more connected and autonomous. For publishers, governance is how trust is earnedâand sustainedâin enterprise environments, enabling responsible AI operations. It signals that AI behavior is intentional, accountable, and aligned with customer expectations, not left to inference or assumption. As AI apps and agents operate across users, data, and systems, risk shifts away from what a model can generate and toward how its behavior is governed in realâworld conditions. Marketplace readiness reflects this shift, defined less by raw capability and more by control, accountability, trust, and adherence to AI compliance standards for publishing. You can always get a curated step-by-step guidance through building, publishing and selling apps for Marketplace through App Advisor. This post is part of aâŻseriesâŻon building and publishing well-architected AI apps and agents in Microsoft Marketplace.âŻThe series focuses on AI apps and agents that are architected, hosted, and operated on Azure, with guidance aligned to building and selling solutions through Microsoft Marketplace. What governance means for AI apps and agents Governance in AI systems is operational and continuous. It is not limited to documentation, checklists, or periodic reviews â it shapes how an AI app or agent behaves while it is running in real customer environments. For AI apps and agents, governance spans three closely connected dimensions: Policy What the system is allowed to do, what data it is allowed to access, what is restricted, and what is explicitly prohibited. Enforcement How those policies are applied consistently in production, even as context, inputs, and conditions change. Evidence How decisions and actions are traced, reviewed, and audited over time. Governance works when intent, behavior, and proof move together â turning expectations into outcomes that can be trusted and examined. These dimensions are interdependent. Policy without enforcement is aspiration. Enforcement without evidence is unverifiable. Governance in action Governance becomes real when responsibility is explicit. For AI apps and agents, this starts with clarity around who is responsible for what: Who the agent acts for â and how its use protects business value Ensuring the agent is used for its intended purpose, produces measurable value, and is not misused, overâextended, or operating outside approved business contexts. Who owns data access and data quality decisions Governing how the agent consumes and produces data, whether access is appropriate, and whether the data used or generated is reliable, accurate, and aligned with business and integrity expectations. Who is accountable for outcomes when behavior deviates Defining responsibility when the agentâs behavior creates risk, degrades value, or produces unexpected outcomes â so corrective action is timely, intentional, and owned. When governance is left vague or undefined, accountability gaps surface and agent actions become difficult to justify and explain across the publisher, the customer, and the solution itself. In this model, responsibility is shared but distinct. The publisher is responsible for designing and implementing the governance capabilities within the solution â defining boundaries, enforcement points, and evidence mechanisms that protect business value by default. Marketplace customers expect to understand who is accountable before they adopt an AI solution, not after an incident forces the question. The customer is responsible for configuring, operating, and applying those capabilities within their own environment, aligning them to internal policies, risk tolerance, and dayâtoâday use. Governance works when both roles are clear: the publisher provides the structure, and the customer brings it to life in practice. Data governance for AI: beyond storage and access For Marketplaceâready AI apps and agents, data governance must account for where data moves, not just where it resides. Understanding how data flows across systems, tools, and tenants is essential to maintaining trust as solutions scale. Data governance for AI apps and agents extends beyond where data is stored. These systems introduce new artifacts that influence behavior and outcomes, including prompts and responses, retrieval context and embeddings, and agentâinitiated actions and tool outputs. Each of these elements can carry sensitive information and shape downstream decisions. Effective data governance for AI apps and agents requires clear structure: Explicit data ownership â defining who owns the data and under what conditions it can be accessed or used Access boundaries and contextâaware authorization â ensuring access decisions reflect identity, intent, and environment, not just static permissions Retention, auditability, and deletion strategies â so data use remains traceable and aligned with customer expectations over time Relying on prompts or inferred intent to determine access is a governance gap, not a shortcut. Without explicit controls, data exposure becomes difficult to predict or explain. Runtime policy enforcement in production Policies are stress tested when the agent is responding to real prompts, touching real data, and taking actions that carry real consequences. For software companies building AI apps and agents for Microsoft Marketplace, runtime policy enforcement is also how you keep the system fit for purpose: aligned to its intended use, supported by evidence, and constrained when conditions change. At runtime, governance becomes enforceable through three clear lanes of behavior: Decisions that require human approval Use approval gates for higherâimpact steps (for example: executing a write operation, sending an external request, or performing an irreversible workflow). This protects the business value of the agent by preventing âhelpfulâ behavior from turning into misuse. Actions that can proceed automatically â within defined limits Automation is earned through clarity: define the agentâs intended uses and keep tool access, data access, and action scope anchored to those uses. Fitâforâpurpose isnât a feeling â itâs something you support with defined performance metrics, known error types, and release criteria that you measure and reâmeasure as the system runs. Behaviors that are never permitted â regardless of context or intent Block classes of behavior that violate policy (including jailbreak attempts that try to override instructions, expand tool scope, or access disallowed data). When an intended use is not supported by evidence â or new evidence shows it no longer holds â treat that as a governance trigger: remove or revise the intended use in customerâfacing materials, notify customers as appropriate, and close the gap or discontinue the capability. To keep runtime enforcement meaningful over time, pair it with ongoing evaluation: document how youâll measure performance and error patterns, run those evaluations preârelease and continuously, and decide how often reâevaluation is needed as models, prompts, tools, and data shift. This is what keeps autonomy intentional. It allows AI apps and agents to operate usefully and confidently, while ensuring behavior remains aligned with defined expectations â and backed by evidence â as systems evolve and scale. Auditability, explainability, and evidence Guardrails are the points in the system where governance becomes observable: where decisions are evaluated, actions are constrained, and outcomes are recorded. As described in Designing AI guardrails for apps and agents in Marketplace, guardrails shape how AI systems reason, access data, and take action â consistently and by default. Guardrails may be embedded within the agent itself or implemented as a separate supervisory layer â another agent or policy service â that evaluates actions before they proceed. Guardrail responses exist on a spectrum. Some enforce in the moment â blocking an action or requiring approval before it proceeds â while others generate evidence for postâhoc review, supported by audit logging for AI agents. Marketplaceâready AI apps and agents could implement both, with the response mode matched to the severity, reversibility, and business impact of the action in question. These expectations align with the governance and evidence requirements outlined in the Microsoft Responsible AI Standard v2 General Requirements. In practice, guardrails support auditability and explainability by: Constraining behavior at design time Establishing clear defaults around what the system can and cannot do, so intended use is enforced before the system ever reaches production. Evaluating actions at runtime Making decisions visible as they happen â which tools were invoked, which data was accessed, and why an action was allowed to proceed or blocked. When governance is unclear, even strong guardrails lose their effectiveness. Controls may exist, but without clear intent they become difficult to justify, unevenly applied across environments, or disconnected from customer expectations. Over time, teams lose confidence not because the system failed, but because they canât clearly explain why it behaved the way it did. When governance and guardrails are aligned, the result is different. Behavior is intentional. Decisions are traceable. Outcomes can be explained without guesswork. Auditability stops being a reporting exercise and becomes a natural byproduct of how the system operates day to day. Aligning governance with Marketplace expectations Governance for AI apps and agents must operate continuously, across all inâscope environments â in both the publisherâs and the customerâs tenants. Marketplace solutions donât live in a single boundary, and governance cannot stop at deployment or certification. Runtime enforcement is what keeps governance active as systems run and evolve. In practice, this means: Blocking or constraining actions that violate policy â such as stopping jailbreak attempts that try to override system instructions, escalate tool access, or bypass safety constraints through crafted prompts Adapting controls based on identity, environment, and risk â applying stricter limits when an agent acts across tenants, accesses sensitive data, or operates with elevated permissions Aligning agent behavior with enterprise expectations in real time â ensuring actions taken on behalf of users remain within approved roles, scopes, and approval paths These controls matter because AI behavior is dynamic. The same agent may behave differently depending on context, inputs, and downstream integrations. Governance must be able to respond to those shifts as they happen. Runtime enforcement is distinct from monitoring. Enforcement determines what is allowed to continue. Monitoring explains what happened once itâs already done. Marketplaceâready AI solutions need both, but governance depends on enforcement to keep behavior aligned while it matters most. Operational health through auditability and traceability Operational health is the combination of traceability (what happened) and intelligibility (how to use it responsibly). When both are present, governance becomes a quality signal customers can feel day to day â not because you promised it, but because the system consistently behaves in ways they can understand and trust. Healthy AI apps and agents are not only traceable â they are intelligible in the moments that matter. For Marketplace customers, operational trust comes from being able to understand what the system is intended to do, interpret its behavior well enough to make decisions, and avoid overârelying on outputs simply because they are produced confidently. A practical way to ground this is to be explicit about who needs to understand the system: Decision makers â the people using agent outputs to choose an action or approve a step Impacted users â the people or teams affected by decisions informed by the systemâs outputs Once those stakeholders are clear, governance shows up as three operational promises you can actually support: Clarity of intended use Customers can see what the agent is designed to do (and what it is not designed to do), so outputs are used in the right contexts. Interpretability of behavior When an agent produces an output or recommendation, stakeholders can interpret it effectively â not perfectly, but reasonably well â with the context they need to make informed decisions. Protection against automation bias Your UX, guidance, and operational cues help customers stay aware of the natural tendency to overâtrust AI output, especially in highâtempo workflows. This is where auditability and traceability become more than logs. Well governed AI systems should still answer: Who initiated an action â a user, an agent acting on their behalf, or an automated workflow What data was accessed â under which identity, scope, and context What decision was made, and why â especially when downstream systems or people are affected The logs should show evidence that stakeholders can interpret those outputs in realistic conditions â and there is a method to evaluate this, with clear criteria for release and ongoing evaluation as the solution evolves. Explainability still needs balance. Customers deserve transparency into intended use, behavior boundaries, and how to interpret outcomes â without requiring you to expose proprietary prompts, internal logic, or implementation details. For more information on securing your AI apps and agents, visit Securing AI apps and agents on Microsoft Marketplace | Microsoft Community Hub. What's next in the journey Governance creates the conditions for AI apps and agents to operate with confidence over time. With clear policies, enforcement, and evidence in place, publishers are better prepared to focus on operational maturity â how solutions are observed, maintained, and evolved safely in production. The next post explores what it takes to keep AI apps and agents healthy as they run, change, and scale in real customer environments. See the next post in the series: Quality and evaluation framework for successful AI apps and agents in Microsoft Marketplace | Microsoft Community Hub. Key resources See curated, step-by-step guidance to help you build, publish, or sell your app or agent (no matter where you start) in App Advisor Quick-Start Development Toolkit can connect you with code templates for AI solution patterns Microsoft AI Envisioning Day Events How to build and publish AI apps and agents for Microsoft Marketplace Get over $126K USD in benefits and technical consultations to help you replicate and publish your app with ISV SuccessDesigning AI guardrails for apps and agents in Marketplace
Why guardrails are essential for AI apps and agents AI apps and agents introduce capabilities that go beyond traditional software. They reason over natural language, interact with data across boundaries, andâin the case of agentsâcan take autonomous actions using tools and APIs. Without clearly defined guardrails, these capabilities can unintentionally compromise confidentiality, integrity, and availability, the foundational pillars of information security. From a confidentiality perspective, AI systems often process sensitive prompts, contextual data, and outputs that may span customer tenants, subscriptions, or external systems. Guardrails ensure that data access is explicit, scoped, and enforcedârather than inferred through prompts or emergent model behavior. From an availability perspective, AI apps and agents can fail in ways traditional software does not â such as runaway executions, uncontrolled chains of tool calls, or usage spikes that drive up cost and degrade service. Guardrails address this by setting limits on how the system executes, how often it calls tools, and how it behaves when something goes wrong. For Marketplace-ready AI apps and agents, guardrails are foundational design elements that balance innovation with security, reliability, and responsible AI practices. By making behavioral boundaries explicit and enforceable, guardrails enable AI systems to operate safely at scaleâmeeting enterprise customer expectations and Marketplace requirements from day one. You can always get a curated step-by-step guidance through building, publishing and selling apps for Marketplace through App Advisor. This post is part of aâŻseriesâŻon building and publishing well-architected AI apps and agents in Microsoft Marketplace.âŻThe series focuses on AI apps and agents that are architected, hosted, and operated on Azure, with guidance aligned to building and selling solutions through Microsoft Marketplace. Using Open Worldwide Application Security Project (OWASP) GenAI Top 10 as a guardrail design lens The OWASP GenAI Top 10 provides a practical framework for reasoning about AIâspecific risks that are not fully addressed by traditional application security models. It helps teams identify where assumptions about trust, input handling, autonomy, and data access are most likely to break down in AIâdriven systems. However, not all OWASP risks apply equally to every AI app or agent. Their relevance depends on factors such as: Agent autonomy, including whether the system can take actions without human approval Data access patterns, especially crossâtenant, crossâsubscription, or external data retrieval Integration surface area, meaning the number and type of tools, APIs, and external systems the agent connects to Because of this variability, OWASP should not be treated as a checklist to implement wholesale. Doing so can lead teams to overâengineer controls in lowârisk areas while leaving critical gaps in places where autonomy, data movement, or tool execution create real exposure. Instead, OWASP is most effective when used as a design lens â to inform where guardrails are needed and what behaviors require explicit boundaries. Understanding risks and enforcing boundaries are two different things. OWASP tells you where to look; guardrails are what you actually build. The goal is not to eliminate all risk, but to use OWASP insights to design selective, intentional guardrails that align with the system's architecture, autonomy, and operating context. Translating AI risks into architectural guardrails OWASP GenAI Top 10 helps identify where AI systems are vulnerable, but guardrails are what make those risks enforceable in practice. Guardrails are most effective when they are implemented as architectural constraintsâdesigned into the systemârather than as runtime patches added after risky behavior appears. In AI apps and agents, many risks emerge not from a single component, but from how prompts, tools, data, and actions interact. Architectural guardrails establish clear boundaries around these interactions, ensuring that risky behavior is prevented by design rather than detected too late. Common guardrail categories map naturally to the types of risks highlighted in OWASP: Input and prompt constraints Address risks such as prompt injection, system prompt leakage, and unintended instruction override by controlling how inputs are structured, validated, and combined with system context. Action and toolâuse boundaries Mitigate risks related to excessive agency and unintended actions by explicitly defining which tools an AI app or agent can invoke, under what conditions, and with what scope. Data access restrictions Reduce exposure to sensitive information disclosure and crossâboundary leakage by enforcing identityâaware, contextâaware access to data sources rather than relying on prompts to imply intent. AI Output validation and moderation Help contain risks such as misinformation, improper output handling, or policy violations by treating AI output as untrusted and subject to validation before it is acted on or returned to users. What matters most is where these guardrails live in the architecture. Effective guardrails sit at trust boundariesâbetween users and models, models and tools, agents and data sources, and control planes and data planes. When guardrails are embedded at these boundaries, they can be applied consistently across environments, updates, and evolving AI capabilities. By translating identified risks into architectural guardrails, teams move from risk awareness to behavioral enforcement that supports safe AI agent operation. This shift is foundational for building AI apps and agents that can operate safely, predictably, and at scale in Marketplace environments. Designâtime guardrails: shaping allowed behavior before deployment The OWASP GenAI Top 10 provides a practical framework for reasoning about AI specific risks that are not fully addressed by traditional application security models. It helps teams identify where assumptions about trust, input handling, autonomy, and data access are most likely to break down in AI driven systems. However, not all OWASP risks apply equally to every AI app or agent. Their relevance depends on factors such as: Agent autonomy, including whether the system can take actions without human approval Data access patterns, especially cross-tenant, cross subscription, or external data retrieval Integration surface area, meaning the number and type of tools, APIs, and external systems the agent connects to Because of this variability, OWASP should not be treated as a checklist to implement wholesale. Doing so can lead teams to over engineer controls in low risk areas while leaving critical gaps in places where autonomy, data movement, or tool execution create real exposure. Instead, OWASP is most effective when used as a design lens â to inform where guardrails are needed and what behaviors require explicit boundaries. Understanding risks and enforcing boundaries are two different things. OWASP tells you where to look; guardrails are what you actually build. The goal is not to eliminate all risk, but to use OWASP insights to design selective, intentional guardrails that align with the system's architecture, autonomy, and operating context. Runtime guardrails: enforcing boundaries as systems operate For Marketplace publishers, the key distinction between monitoring and runtime guardrails is simple: Monitoring tells you what happened after the fact. Runtime guardrails are inline controlsâpart of runtime AI safety controlsâthat can block, pause, throttle, or require approval before an action completes. If you want prevention, the control has to sit in the execution path. At runtime, guardrails should constrain three areas: Agent decision paths (prevent runaway autonomy) Cap planning and execution. Limit the agent to a maximum number of steps per request, enforce a maximum wallâclock time, and stop repeated loops. Apply circuit breakers. Terminate execution after a specified number of tool failures or when downstream services return repeated throttling errors, reinforcing autonomous agent limits. Require explicit escalation. When the agentâs plan shifts from âreadâ to âwrite,â pause and require approval before continuing. Tool invocation patterns (control what gets called, how, and with what inputs) Enforce allowlists. Allow only approved tools and operations, and block any attempt to call unregistered endpoints. Validate parameters. Reject tool calls that include unexpected tenant identifiers, subscription scopes, or resource paths. Throttle and quota. Rateâlimit tool calls per tenant and per user, and cap token/tool usage to prevent cost spikes and degraded service. Crossâsystem actions (constrain outbound impact at the boundary you control) Runtime guardrails cannot âreach intoâ external systems and stop independent agents operating elsewhere. What publishers can do is enforce policy atâŻyour solutionâs outbound boundary: the tool adapter, connector, API gateway, or orchestration layer that your app or agent controls. Concrete examples include: Block highârisk operations by default (delete, approve, transfer, send) unless a human approves. Restrict write operations to specific resources (only this resource group, only this SharePoint site, only these CRM entities). Require idempotency keys and safe retries so repeated calls do not duplicate side effects. Log every attempted crossâsystem write with identity, scope, and outcome, and fail closed when policy checks cannot run. Done well, runtime guardrails produce evidence, not just intent. They show reviewers that your AI app or agent enforces least privilege, prevents runaway execution, and limits blast radiusâeven when the model output is unpredictable. Guardrails across data, identity, and autonomy boundaries Guardrails don't work in silos. They are only effective when they align across the three core boundaries that shape how an AI app or agent operates â identity, data, and autonomy. Guardrails must align across: Identity boundaries (who the agent acts for) â represent the credentials the agent uses, the roles it assumes, and the permissions that flow from those identities. Without clear identity boundaries, agent actions can appear legitimate while quietly exceeding the authority that was actually intended. Data boundaries (what the agent can see or retrieve) â ensuring access is governed by explicit authorization and context, not by what the model infers or assumes. A poorly scoped data boundary doesn't just create exposure â it creates exposure that is hard to detect until something goes wrong. Autonomy boundaries (what the agent can decide or execute) â defining which actions require human approval, which can proceed automatically, and which are never permitted regardless of context. Autonomy without defined limits is one of the fastest ways for behavior to drift beyond what was ever intended. When these boundaries are misaligned, the consequences are subtle but serious. An agent may act under the authority of one identity, access data scoped to another, and execute with broader autonomy than was ever granted â not because a single control failed, but because the boundaries were never reconciled with each other. This is how unintended privilege escalation happens in well-intentioned systems. Balancing safety, usefulness, and customer trust Getting guardrails right is less about adding controls and more about placing them well. Too restrictive, and legitimate workflows break down, safe autonomy shrinks, and the system becomes more burden than benefit. Too permissive, and the risks accumulate quietly â surfacing later as incidents, audit findings, or eroded customer trust. Effective guardrails share three characteristics that help strike that balance: Transparent â customers and operators understand what the system can and cannot do, and why those limits exist Context-aware â boundaries tighten or relax based on identity, environment, and risk, without blocking safe use Adjustable â guardrails evolve as models and integrations change, without compromising the protections that matter most When these characteristics are present, guardrails naturally reinforce the foundational principles of information security â protecting confidentiality through scoped data access, preserving integrity by constraining actions to authorized paths, and supporting availability by preventing runaway execution and cascading failures. How guardrails support Marketplace readiness For AI apps and agents in Microsoft Marketplace, guardrails are a practical enabler â not just of security, but of the entire Marketplace journey. They make complex AI systems easier to evaluate, certify, and operate at scale. Guardrails simplify three critical aspects of that journey: Security and compliance review â explicit, architectural guardrails give reviewers something concrete to assess. Rather than relying on documentation or promises, behavior is observable and boundaries are enforceable from day one. Customer onboarding and trust â when customers can see what an AI system can and cannot do, and how those limits are enforced, adoption decisions become easier and time to value shortens. Clarity is a competitive advantage. Long-term operation and scale â as AI apps evolve and integrate with more systems, guardrails keep the blast radius contained and prevent hidden privilege escalation paths from forming. They are what makes growth manageable. Marketplace-ready AI systems don't describe their guardrails â they demonstrate them. That shift, from assurance to evidence, is what accelerates approvals, builds lasting customer trust, and positions an AI app or agent to scale with confidence. Whatâs next in the journey Guardrails establish the foundation for safe, predictable AI behavior â but they are only the beginning. The next phase extends these boundaries into governance, compliance, and dayâtoâday operations through policy definition, auditing, and lifecycle controls. Together, these mechanisms ensure that guardrails remain effective as AI apps and agents evolve, scale, and operate within enterprise environments. See the next post in the series: Governing AI apps and agents for Marketplace | Microsoft Community Hub. Key resources See curated, step-by-step guidance to help you build, publish, or sell your app or agent (no matter where you start) in App Advisor, Quick-Start Development Toolkit can connect you with code templates for AI solution patterns Microsoft AI Envisioning Day Events How to build and publish AI apps and agents for Microsoft Marketplace Get over $126K USD in benefits and technical consultations to help you replicate and publish your app with ISV SuccessSecuring AI apps and agents on Microsoft Marketplace
Why security must be designed inânot validated later AI apps and agents expand the security surface beyond that of traditional applications. Prompt inputs, agent reasoning, tool execution, and downstream integrations introduce opportunities for misuse or unintended behavior when security assumptions are implicit. These risks surface quickly in production environments where AI systems interact with real users and data. Deferring security decisions until late in the lifecycle often exposes architectural limitations that restrict where controls can be enforced. Retrofitting security after deployment is costly and can force tradeoffs that affect reliability, performance, or customer trust. Designing security early establishes clear boundaries, enables consistent enforcement, and reduces friction during Marketplace review, onboarding, and longâterm operation. In the Marketplace context, security is a foundational requirement for trust and scale. You can always get a curated step-by-step guidance through building, publishing and selling apps for Marketplace through App Advisor. This post is part of aâŻseriesâŻon building and publishing well-architected AI apps and agents in Microsoft Marketplace.âŻThe series focuses on AI apps and agents that are architected, hosted, and operated on Azure, with guidance aligned to building and selling solutions through Microsoft Marketplace. How AI apps and agents expand the attack surface Without a clear view of where trust boundaries exist and how behavior propagates across systems, security controls risk being applied too narrowly or too late. AI apps and agents introduce security risks that extend beyond those of traditional applications. AI systems accept openâended prompts, reason dynamically, and often act autonomously across systems and data sources. These interaction patterns expand the attack surface in several important ways: New trust boundaries introduced by prompts and inputs, where unstructured user input can influence reasoning and downstream actions Autonomous behavior, which increases the blast radius when authentication or authorization gaps exist Tool and integration execution, where agents interact with external APIs, plugins, and services across security domains Dynamic model responses, which can unintentionally expose sensitive data or amplify errors if guardrails are incomplete Each API, plugin, or external dependency becomes a security choke point where identity validation, audit logging, and data handling must be enforced consistently as part of securing AI integrationsâespecially when AI systems span tenants, subscriptions, or ownership boundaries. Using OWASP GenAI Top 10 as a threat lens The OWASP GenAI Top 10 provides a practical, industryârecognized lens for identifying and categorizing AIâspecific security threats that extend beyond traditional application risks. Rather than serving as a checklist, the OWASP GenAI Top 10 helps teams ask the right questions early in the design process. It highlights where assumptions about trust, input handling, autonomy, and data access can break down in AIâdriven systemsâoften in ways that are difficult to detect after deployment. Common risk categories highlighted by OWASP include: Prompt injection and manipulation, where malicious input influences agent behavior or downstream actions Sensitive data exposure, including leakage through prompts, responses, logs, or tool outputs Excessive agency, where agents are granted broader permissions or action scope than intended Insecure integrations, where tools, plugins, or external systems become unintended attack paths Highly regulated industries, sensitive data domains, or missionâcritical workloads may require additional risk assessment and security considerations that extend beyond the OWASP categories. The OWASP GenAI Top 10 allows teams to connect highâlevel risks to architectural decisions by creating a shared vocabulary that sets the foundation for designing guardrails that are enforceable both at design time and at runtime. Designing security guardrails into the architecture Security guardrails must be designed into the architecture, shaping where and how policies are enforced, evaluated, and monitored throughout the solution lifecycle. Guardrails operate at two complementary layers: Design time, where architectural decisions determine what is possible, permitted, or blocked by default Runtime, where controls actively govern behavior as the AI app or agent interacts with users, data, and systems When architectural boundaries are not defined early, teams often discover that critical controlsâsuch as input validation, authorization checks, or action constraintsâcannot be applied consistently without redesign: Tenancy boundaries, defining how isolation is enforced between customers, environments, or subscriptions Identity boundaries, governing how users, agents, and services authenticate and what actions they can perform Environment separation, limiting the blast radius of experimentation, updates, or failures Control planes, where configuration, policy, and behavior can be adjusted without redeploying core logic Data planes, controlling how data is accessed, processed, and moved across trust boundaries Designing security guardrails into the architecture transforms security from reactive to preventative, while also reducing friction later in the Marketplace journey. Clear enforcement boundaries simplify review, clarify risk ownership, and enable AI apps and agents to evolve safely as capabilities and integrations expand. Identity as a security boundary for AI apps and agents Identity defines who can access the system, what actions can be taken, and which resources an AI app or agent is permitted to interact with across tenants, subscriptions, and environments. Agents often act on behalf of users, invoke tools, and access downstream systems autonomously. Without clear identity boundaries, these actions can unintentionally bypass leastâprivilege controls or expand access beyond what users or customers expect. Strong identity design shapes security in several key ways: Authentication and authorization, determines how users, agents, and services establish trust and what operations they are allowed to perform Delegated access, constraints agents to act with permissions tied to user intent and context Serviceâtoâservice trust, ensures that all interactions between components are explicitly authenticated and authorized Auditability, traces actions taken by agents back to identities, roles, and decisions A zeroâtrust AI agent architecture is essential in this context. is essential in this context. Every requestâwhether initiated by a user, an agent, or a backend serviceâshould be treated as untrusted until proven otherwise. Identity becomes the primary control plane for enforcing least privilege, limiting blast radius, and reducing downstream integration risk. This foundation not only improves security posture, but also supports compliance, simplifies Marketplace review, and enables AI apps and agents to scale safely as integrations and capabilities evolve. Protecting data across boundaries Data may reside in customerâowned tenants, subscriptions, or external systems, while the AI app or agent runs in a publisherâmanaged environment or a separate customer environment. Protecting data across boundaries requires teams to reason about more than storage location. Several factors shape the security posture: Data ownership, including whether data is owned and controlled by the customer, the publisher, or a third party Boundary crossings, such as crossâtenant, crossâsubscription, or crossâenvironment access patterns Data sensitivity, particularly for regulated, proprietary, or personally identifiable information Access duration and scope, ensuring data access is limited to the minimum required context and time When these factors are implicit, AI systems can unintentionally broaden access through prompts, retrievalâaugmented generation, or agentâinitiated actions. This risk increases when agents autonomously select data sources or chain actions across multiple systems. To mitigate these risks, access patterns must be explicit, auditable, and revocable. Data access should be treated as a continuous security decision, evaluated on every interaction rather than trusted by default once a connection exists. This approach aligns with zero-trust principles, where no data access is implicitly trusted and every request is validated based on identity, context, and intent. Runtime protections and monitoring For AI apps and agents, security does not end at deployment. In customer environments, these systems interact continuously with users, data, and external services, making runtime visibility and control essential to a strong security posture. AI behavior is also dynamic: the same prompt, context, or integration can produce different outcomes over time as models, data sources, and agent logic evolve, so monitoring must extend beyond infrastructure health to include behavioral signals that indicate misuse, drift, or unintended actions. Effective runtime protections focus on five core capabilities: Vulnerability management, including regular scanning of the full solution to identify missing patches, insecure interfaces, and exposure points Observability, so agent decisions, actions, and outcomes can be traced and understood in production Behavioral monitoring, to detect abnormal patterns such as unexpected tool usage, unusual access paths, or excessive action frequency Containment and response, enabling rapid intervention when risky or unauthorized behavior is detected Forensics readiness, ensuring system-state replicability and chain-of-custody are retained to investigate what happened, why it happened, and what was impacted Monitoring that only tracks availability or performance is insufficient. Runtime signals must provide enough context to explain not just what happened, but why an AI app or agent behaved the way it did, and which identities, data sources, or integrations were involved. Equally important is integration with broader security event and incident management workflows. Runtime insights should flow into existing security operations so AI-related incidents can be triaged, investigated, and resolved alongside other enterprise security eventsâotherwise AI solutions risk becoming blind spots in a customerâs operating environment. Preparing for incidents and abuse scenarios No AI app or agent operates in a perfectly controlled environment. Once deployed, these systems are exposed to real users, unpredictable inputs, evolving data, and changing integrations. Preparing for incidents and abuse scenariosâincluding AI agent incident responseâis therefore a core security requirement, not a contingency plan. AI apps and agents introduce unique incident patterns compared to traditional software. In addition to infrastructure failures, teams must be prepared for prompt abuse, unintended agent actions, data exposure, and misuse of delegated access. Because agents may act autonomously or continuously, incidents can propagate quickly if safeguards and response paths are unclear. Effective incident readiness starts with acknowledging that: Abuse is not always malicious, misuse can stem from ambiguous prompts, unexpected context, or misunderstood capabilities Agent autonomy may increase impact, especially when actions span multiple systems or data sources Security incidents may be behavioral, not just technical, requiring interpretation of intent and outcomes Preparing for these scenarios requires clearly defined response strategies that account for how AI systems behave in production. AI solutions should be designed to support pause, constrain, or revoke agent capabilities when risk is detected, and to do so without destabilizing the broader system or customer environment. Incident response must also align with customer expectations and regulatory obligations. Customers need confidence that AIârelated issues will be handled transparently, proportionately, and in accordance with applicable security and privacy standards. Clear boundaries around responsibility, communication, and remediation help preserve trust when issues arise. How security decisions shape Marketplace readiness From initial review to customer adoption and longâterm operation, security posture is a visible and consequential signal of readiness. AI apps and agents with clear boundariesâaround identity, data access, autonomy, and runtime behaviorâare easier to evaluate, onboard, and trust. When security assumptions are explicit, Marketplace review becomes more predictable, customer expectations are clearer, and operational risk is reduced. Ambiguous trust boundaries, implicit data access, or uncontrolled agent actions can introduce friction during review, delay onboarding, or undermine customer confidence after deployment. Marketplaceâready security is therefore not about meeting a minimum bar. It is about enabling scale. Well-designed security allows AI apps and agents to integrate into enterprise environments, align with customer governance models, and evolve safely as capabilities expand. When security is treated as a firstâclass architectural concern, it becomes an enabler rather than a blockerâsupporting faster time to market, stronger customer trust, and sustainable growth through Microsoft Marketplace. Whatâs next in the journey Security for AI apps and agents is not a oneâtime decision, but an ongoing design discipline that evolves as systems, data, and customer expectations change. By establishing clear boundaries, embedding guardrails into the architecture, and preparing for realâworld operation, publishers create a foundation that supports safe iteration, predictable behavior, and longâterm trust. This mindset enables AI apps and agents to scale confidently within enterprise environments while meeting the expectations of customers adopting solutions through Microsoft Marketplace. See the next post in the series: Designing AI guardrails for apps and agents in Marketplace | Microsoft Community Hub. Key resources See curated, step-by-step guidance to help you build, publish, or sell your app or agent (no matter where you start) in App Advisor, Quick-Start Development Toolkit Microsoft AI Envisioning Day Events How to build and publish AI apps and agents for Microsoft Marketplace Get over $126K USD in benefits and technical consultations to help you replicate and publish your app with ISV SuccessHow to get heard by Microsoft and win more together
At Ultimate Partner LIVE Bellevue, May 11-13, some of the sharpest practitioners in the Microsoft ecosystem are coming together to share what works. These are candid, practitioner-led sessions built for senior leaders who need to walk away with something they can use, not a framework to revisit in six months. đď¸ Sessions Worth Your Time đ° Marketplace Meets AI: The New Route to Partner Revenue Cyril Belikoff, VP Microsoft Azure ¡ Jon Yoo, CEO Suger Cyril Belikoff helped architect the unified Microsoft Marketplace and launched the resale enabled offer, which lets channel partners bundle software development company solutions and transact against Azure commit. Within the 1st week of GA, partners were already processing deals at scale. Cyril joins Vince Menzione and Jon Yoo, CEO of Suger, on Day 1 to cover where the AI-driven marketplace motion is heading and what partners need to do now to capture their share of the revenue flowing through it. Cyrilâs advice for the partner still on the sideline is direct: do not try to boil the ocean. Get listed. Create offerings. Figure out 1 or 2 deals, transact them, and see the opportunity. This session gives you the map. đŻ From Attention to Trust: The New Rules of Hyperscaler Go-To-Market Ashleigh Vogstad, CEO Transcends ¡ Leigh Ann Campbell, Principal REV Alliances We are no longer in an attention economy. You are not competing to be seen. You are competing to be trusted, and the shift has a specific mechanism. AI agents are already making procurement decisions using verified signals: co-sell track records, Partner Center data, marketplace history, certifications. The partners building that record now are building an advantage that compounds quickly and is difficult to replicate later. Leigh Ann Campbell has driven over $200 million in influenced and net-new revenue through the Microsoft partner ecosystem. She knows what happens to a referral the moment it lands in Partner Center and what you need to do to make sure it does not die there. Ashleigh Vogstad, CEO of Transcends, brings the broader GTM lens on how the trust economy is changing what buyers respond to and where most partner marketing misses the mark. đ Partner to Pipeline: Activating your GTM Strategy Reis Barrie, CEO Carve Partners ¡ Greg Goldkamp, Sr. Director Microsoft This is the rare combination of a partner who has built real pipeline through Microsoftâs co-sell motion and a Microsoft leader who can tell you directly what gets field attention and what gets ignored. Most software companies approach co-sell as a relationship exercise. The ones generating real pipeline treat it as a system. They know which solution plays are active in the current fiscal year. They show up in seller conversations before a deal is open. They make it easy for a Microsoft seller to bring them in because the pitch is already mapped to what that seller is measured on. This session covers how to build that system, from first registration in Partner Center through closed pipeline. đ From Connector to Catalyst: Todayâs Alliance Manager Erin Figer, Founder CORE Consulting ¡ Christine Bongard, CEO The WIT Network ¡ Steven Karachinsky, CEO ZIRO Erin Figer helped build the co-sell practices at Microsoft, AWS, and Google Cloud when those programs were still being designed. She brings a reframe that changes how the best alliance teams operate: before you can market with a hyperscaler, you have to market to them. Treat Microsoft like a customer. Understand their priorities, their fiscal calendar, their field incentives. Build the internal credibility that gets you pulled into deals instead of chasing them. Joined by Christine Bongard and Steven Karachinsky, this session covers what the transition from connector to catalyst looks like in practice and what separates the alliance managers who generate revenue from those who manage relationships. đĄ Why the practitioner track matters These are not panel discussions with safe answers. This audience asks direct questions, and the speakers in these sessions are prepared to give direct answers. These sessions run across both days alongside 2 full tracks of mainstage content covering marketplace, distribution, AI strategy, and Microsoftâs channel priorities heading into FY27. đ UP LIVE Bellevue ¡ May 11â13, 2026 InterContinental Hotel, Bellevue, WA đ Exclusive discount for Microsoft partners Use code ULTIMATEVIP50 at checkout for a special discount reserved for Microsoft partners. đ Register for UP LIVE Bellevue Ultimate PartnerÂŽ is the premier independent platform for technology partnership leaders, uniting the hyperscaler ecosystem to achieve their greatest results through partnering. An official Microsoft GPS recognized community.Design tenant linking to scale selling on Microsoft Marketplace
Designing tenant linking and Open Authorization (OAuth) directly shapes how customers onboard, grant trust, and operate your AI app or agent through Microsoft Marketplace. This post explains how to design scalable, reviewâready identity patterns that support secure activation, clear authorization boundaries, and enterprise trust from day one. Guidance for multiâtenant AI apps Identity decisions are rarely visible in architecture diagrams, but they are immediately visible to customers. In Microsoft Marketplace, tenant linking and OAuth consent are not background implementation details. They shape activation, onboarding, certification, and longâterm trust with enterprise buyers. When identity decisions are made late, the impact is predictable. Onboarding breaks. Permissions feel misaligned. Reviews stall. Customers hesitate. When identity is designed intentionally from the start, Marketplace experiences feel coherent, secure, and enterpriseâready. This post focuses on how software development companies (like ISVs) can design tenant linking and consent patterns that scale across customers, offer types, and Marketplace reviewâwithout rework later. You can always get curated step-by-step guidance through building, publishing and selling apps for Marketplace through App Advisor. This post is part of a series that focuses on AI apps and agents that are architected, hosted, and operated on Azure, with guidance aligned to building and selling solutions through Microsoft Marketplace. Why identity across tenants is a firstâclass design decision Designing identity is not just about authentication. It is about how trust is established between your solution and a customer tenant, and how that trust evolves over time. When identity decisions are deferred, failure modes surface quickly: Activation flows that cannot complete cleanly Consent requests that do not match declared functionality Overâprivileged apps that fail security review Customers who cannot confidently revoke access These are not edge cases. They are some of the most common reasons Marketplace onboarding slows or certifications are delayed. A good identity and access management design ensures that trust, consent, provisioning, and operation follow a predictable and reviewable pathâone that customers understand and administrators can approve. Marketplace tenant linking requirements A key mental model simplifies everything that follows: separate trust establishment from authorization. Tenant linking and OAuth consent solve different problems. Tenant linking establishes trust between tenants OAuth consent grants permission within that trust Tenant linking answers: Which customer tenant does this solution trust? OAuth consent answers: What is this solution allowed to do once trusted? AI solutions published in Microsoft Marketplace should enforce this separation intentionally. Trust must be established before meaningful permissions are granted, and permission scope must align to declared functionality. Making this distinction explicit early prevents architectural shortcuts that later block certification. Throughout the rest of this post, tenant linking refers to trust establishment, not permission scope. Microsoft Entra ID as the identity foundation Microsoft Entra ID provides the primitives for identity-based access control, but the concepts only become useful when translated into publisher decisions. Each core concept maps to a choice you make early: Home tenant vs resource tenant Determines where operational control lives and how crossâtenant trust is anchored. App registrations Define the maximum permission boundary your solution can ever request. Service principals Determine how your app appears, is governed, and is managed inside customer tenants. Managed identities Reduce longâterm credential risk and operational overhead. Understanding these decisions early prevents redesigning consent flows, reâcertifying offers, or reâprovisioning customers later. Marketplace policies reinforce this by allowing only limited consent during activation, with broader permissions granted incrementally after onboarding. Importantly, activation consent is not operational consent. Activation establishes the commercial and identity relationship. Operational permissions come later, when customers understand what your solution will actually do. OAuth consent patterns for multiâtenant AI apps OAuth consent is not an implementation detail in Marketplace. It directly determines whether your AI app can be certified, deployed smoothly, and governed by enterprise customers. Common consent patterns map closely to AI behavior: User consent Supports readâonly or userâinitiated interactions with no autonomous actions. Admin consent Enables agents, background jobs, crossâuser access, and crossâresource operations. Preâauthorized consent Enables predictable, enterpriseâgrade onboarding with known and approved scopes. While some AI experiences begin with userâdriven interactions, most AI solutions in Marketplace ultimately require admin consent. They operate asynchronously, act across resources, or persist beyond a single user session. Aligning expectations early avoids friction during review and deployment. Designing consent flows customers trust Consent dialogs are part of your product experience. They are not just Microsoftâprovided UI. Marketplace reviewers evaluate whether requested permissions are proportional to declared functionality. Overâscoped consent remains one of the most common causes of delayed or failed certification. Strong consent design: Requests only what is necessary for declared behavior Explains why permissions are needed in plain language Aligns timing with customer understanding Poor explanations increase admin rejection rates, even when permissions are technically valid. Clear consent copy builds trust and accelerates approvals. Tenant linking across offer types Identity design must align with offer type; a helpful framing is ownership: SaaS offers The publisher owns identity orchestration and tenant linking. Microsoft Marketplace reviewers expect this alignment, and mismatches surface quickly during certification. Containers and virtual machines The customer owns runtime identity; the publisher integrates with it. Managed applications Responsibility is shared, but the publisher defines the trust boundary. Each model carries different expectations for control, consent, and revocation. Designing tenant linking that matches the offer type reduces customer confusion. When consent actually happens in Marketplace lifecycle Many identity issues stem from unclear timing. A simple lifecycle helps anchor expectations: Buy â The customer purchases the offer Activate â Tenant trust is established Consent â Limited activation consent is granted Provision â Resources and configurations are created Operate â Incremental operational consent may be requested Revoke â Access and trust can be cleanly removed Making this sequence explicit in your designâand in your documentationâdramatically reduces confusion for customers and reviewers alike. How tenant linking shapes Marketplace readiness Identity tends to leave a lasting impression as it is one of the first architectural design choices encountered by customers. Strong tenant linking and consent design leads to: Faster certification (applies to SaaS offer only) Fewer conditional approvals Lower onboarding dropâoff Easier enterprise security reviews These outcomes are not accidental. They reflect intentional design choices made early. Whatâs next in the journey Tenant identity sets the foundation, but it is only one part of Marketplace readiness. In upcoming guidance, weâll connect identity decisions to commerce, SaaS Fulfillment APIs, and operational lifecycle managementâso buy, activate, provision, operate, and revoke work together as a single, coherent system. Key Resources See curated, step-by-step guidance to help you build, publish, or sell your app or agent (no matter where you start) in App Advisor Quick-Start Development Toolkit can connect you with code templates for AI solution patterns Microsoft AI Envisioning Day Events How to build and publish AI apps and agents for Microsoft Marketplace Get over $126K USD in benefits and technical consultations to help you replicate and publish your app with ISV SuccessMicrosoft Marketplace Partner Digest | April 2026
April kickstarts a fast-paced quarter of accelerated opportunity as partners line up new coâsell motions and expand channelâled salesâincluding resaleâenabled offersâto reach more customers across global markets, all while rapidly building and publishing transactable AI apps and agents to Microsoft Marketplace to meet growing customer demand. ⨠Microsoft Cloud AI Partner Program This month brings several important updates to Specializations and Solutions Partner designations, including revised performance criteria for the Small and Midsize Business Management specialization and new skilling options across Modern Work, Teams, and Digital & App Innovation. Microsoft is also evolving specializations to better reflect the shift toward AIâintroducing the Secure AI Productivity specialization, retiring the Adoption and Change Management specialization, and preparing to merge several existing specializations into streamlined, solutionâaligned offerings. Learn more đ Whatâs new in Partner Center MFA enforcement for Partner Center APIs Partner Center is now enforcing multifactor authentication (MFA) for all app + user API calls, with full enforcement as of April 1, 2026. Any requests made without a valid MFA token will be blocked with a 401 response and error code 900421. All APIs already support MFA, so update your systems now to avoid disruptions, strengthen security, and align with Partner Center requirements. Learn more đ Go-to-market with Microsoft Marketplace Microsoft has released a new collection of Azure goâtoâmarket assets built specifically for SMB audiences, giving partners stepâbyâstep guidance, tailored messaging, and readyâtoâuse materials to drive demand in a rapidly expanding market projected to surpass $1 trillion by 2030. This content library equips distributors, resellers, and service providers with everything needed to engage SMB customers at scaleâfrom solution plays and sales resources to campaignâready materialsâhelping partners build pipeline, deepen customer conversations, and grow recurring cloud revenue. Partners can explore the full Azure SMB content collection to activate these assets in upcoming campaigns and accelerate their cloud practice growth. Explore resources to engage Azure SMB customers Reduced Microsoft Dragon Copilot pricing Partners can now access a full library of Dragon Copilot training and goâtoâmarket resources, including sales pitch decks, messaging and positioning guides, demo materials, FAQs, data sheets, infographics, and moreâeach with detailed descriptions to help teams understand how and when to use them. These materials are designed to help Dragon Copilot partners confidently market, sell, and support the solution with consistent, enterpriseâready content. Access Dragon Copilot partner assets Plus, new Microsoft Dragon Copilot partner resources Additionally, Microsoft has announced a reduced list price for the Dragon Copilot perâuser license, effective May 1, 2026, across all current geographies. This update simplifies pricing, expands competitiveness, and retires the separate Physician Practice offer, consolidating all capabilities into the standard license. A new perâencounter consumption model for ambient and generative AI capabilities will also launch on May 1, making usage easier to understand and manage. Together, these changes create a more streamlined, costâeffective path for partners to drive Dragon Copilot adoption and growth. Read the announcement Marketplace offer optimization recommendations in App Advisor Microsoft has introduced a new AIâpowered Marketplace listing optimization capability in App Advisor, giving partners instant, personalized recommendations to improve the clarity, quality, and discoverability of their public Marketplace listings. The tool evaluates listings across six key categoriesâfrom value proposition to grammarâand provides targeted guidance aligned with Marketplace best practices, helping partners iterate faster without manual review cycles. Available free and on demand in the US, this capability enables continuous optimization so partners can strengthen engagement, improve search visibility, and stand out in an increasingly competitive catalog. Get recommendations for your Marketplace offer đĄStay up to date with regular Partner Center announcements đ Marketplace events The Marketplace trainings and events calendar is updated with new trainings, live demos, and partnerâfocused sessions designed to help software companies and channel partners accelerate coâsell, private offers, and Marketplaceâfirst sales growth. Catch up on recent webinars and register for upcoming events that break down proven strategies, best practices, and highlight tools and resources to strengthen your Marketplace motions. Recent events Why Azure belongs in your multi-cloud strategy April 2, 2026 This event helps Marketplaceâaligned software companies understand why incorporating Azure into their multi-cloud strategy can boost customer acquisition, deal velocity, and coâsell success. Partners will hear how to replicate solutions for Azure, tap into Microsoft funding programs, leverage tools that speed timeâtoâmarket, and convert modernization efforts into sustained Marketplace growth đĽ Watch the recording Upcoming events Seamless private offers: From creation to purchase and activation April 15, 2026 (8:30 AM PDT) Next weekâs session with Stephanie_Briceâ and Chr_Brownâ will provide partners an endâtoâend look at how to execute seamless private offersâfrom creating them in Partner Center to extending them across channelâled sales motions such as multiparty private offers, CSP private offers, all the way through customer purchase and activation. With a live demo, guidance on resale enabled offers and flexible billing schedules, and time for Q&A, attendees will see exactly how private offers work in practice to streamline deal execution and accelerate Marketplace business growth. Register to attend Maximize selling with Microsoft and Marketplace ROI April 28, 2026 (8:30 AM PDT) Partners will learn how to simplify their Microsoft coâsell motions, unlock underutilized incentives, and automate manual Partner Center tasks using WorkSpan. Drawing on workflows that have powered more than $5B in coâsell revenue, this session covers how to apply for Azure sponsorship, earn and activate Marketplace Rewards benefits, and use WorkSpanâs AIâpowered platform to drive earlier seller actions and stronger partnership execution. Itâs a practical guide to capturing more value from the Microsoft ecosystem. Register to attend Revisit past sessions and see the full calendar of Marketplace community events for partners and customers. Whether youâre expanding coâsell motions, publishing new AIâpowered solutions, optimizing privateâoffer execution, or tapping into updated programs like Dragon Copilot, the opportunities to reach more customers and accelerate growth continue to expand. As always, we welcome your insights and feedbackâlet us know what topics youâd like to see covered in a future post so we can continue shaping this digest around what matters most to you.
