Microsoft Marketplace MCP Server, Explained

The Marketplace Ingestion MCP server is Microsoft’s Model Context Protocol server for Microsoft Marketplace publishing: it lets an AI agent create, validate, publish and manage your offers through Partner Center’s Product Ingestion API and Private offers API. Here’s what each of its ten tools changes, what you need before connecting it, and where a person still decides.

---

Acme publishes a SaaS offer and a Microsoft 365 Copilot agent on Microsoft Marketplace, and its engineers already work in Visual Studio Code with GitHub Copilot. So when Microsoft put an MCP server in front of its publishing APIs, handing the offers to an agent looked like a small step. Acme’s marketplace ops lead has three questions first: what can the agent change, what does it need, and where does a person still decide?

Microsoft answers nearly all of it on one Microsoft Learn page, which this explainer works through tool by tool. For the wider question of connecting an assistant to marketplace data, and the permission model any such server has to enforce, see MCP for cloud GTM.

What is the Microsoft Marketplace MCP server?

The Microsoft Marketplace MCP server, which Microsoft names the Marketplace Ingestion MCP server, is a Model Context Protocol server that “connects agents to the Partner Center Product Ingestion API and the Private offers API.” Instead of building submission payloads by hand, you describe the outcome in natural language, and the agent uses the server’s tools to look up your data, build and validate a payload, and move the offer through publishing.

• It comes with API access. Microsoft says the server “is included with your access to the Marketplace submission APIs.” Clients connect to https://ingestion-mcp.marketplace-ingestion.mp.microsoft.com/mcp.
• It is documented and offered by Microsoft. The Learn page for the server was last updated on October 9, 2026, and Microsoft introduced the server on its Marketplace blog on October 5, 2026, in Bring Marketplace publishing into your agentic development workflow.
• It tracks the API. The server “stays in sync with the Product Ingestion API, so you pick up updates without reconfiguring your process,” and Microsoft suggests it for repeatable offer workflows, “including in your CI/CD pipelines.”

Which offer types and sales motions does it support?

Six offer types and five sales motions, which Microsoft publishes as two separate lists. The Learn page doesn’t say which motions apply to which offer types, so read them as two lists rather than a grid.

Offer types:

• SaaS offers
• Azure virtual machine offers
• Azure container offers
• Microsoft 365 Copilot apps and agents
• Copilot Studio connectors and agents
• Office add-ins and SharePoint solutions

Sales motions:

• Public offers
• Private offers
• Multiparty private offers
• CSP private offers
• Resale enabled offers

Before you build an agent workflow around one combination, confirm in Partner Center that your offer type supports that motion.

The private-offer motions run through Microsoft’s Private offers API, whose own page now points to the server: “We now have MCP support for Private offers.” That API covers three kinds of private offer:

• A customer private offer, “a custom deal between a software company and a specific customer.”
• A CSP private offer, which lets software companies “specify time-bound margin to create a wholesale price for their CSP partner.”
• A multiparty private offer, in which the originator sets the wholesale price and one channel partner, the seller, adds a markup and presents the offer to the customer. Microsoft says “the same MPO originator/channel partner publishing flow and business rules governing Partner Center are mirrored in the API,” so what an agent can edit depends on which side of the deal its account sits on.

Creating, withdrawing or deleting a private offer runs as a job: the API returns a job ID, and Microsoft asks you not to poll a job more than once per minute. That asynchronous model is why creating private offers by API is mostly about what happens after the request returns, whether a person or an agent sends it.

What does each of its ten tools change, and where do you decide?

Four of the ten tools change nothing, four change your offers, and two move files and credentials while the agent works with references. Microsoft’s own example shows how they combine. Asked for a new SaaS offer, the agent calls getSchema for the requirements, buildPayload to assemble a payload, validate to check it and create to save the offer as a draft. Publishing is a separate request, in which the agent calls doAction to certify and publish.

The second column is Microsoft’s; the last two are our reading of it, against the rules of the API underneath.

Tool	What it does, in Microsoft’s words	What it changes in Partner Center	Where you decide
Discover: fetch	”Look up your data: seller profile, offers, plans, listings, templates, and the status of in-progress jobs”	Nothing	No change to approve
Discover: getSchema	”Get the schema (required fields and structure) for any resource type”	Nothing	No change to approve
Build: buildPayload	”Generate a submit-ready payload from your inputs” and “surface any validation warnings”	Nothing yet	Read the payload and its warnings before anything is created
Build: validate	”Check a single resource or a full offer payload against the Marketplace schemas before you submit”	Nothing	A pass is a schema check, not Microsoft’s certification
Change: create	”Create a Marketplace entity, such as an offer, plan, or listing”	A new entity; in Microsoft’s example, an offer saved as a draft	Approve the call in your MCP client
Change: update	”Update an offer or resource with new values”	The draft, until a publish, with one exception below	Approve the call, and treat an audience change on a live plan as a publish
Change: delete	”Remove a draft sub-resource from your offer”	Removes a draft sub-resource	Approve the call: Microsoft’s API says deleting a draft resource can’t be undone
Change: doAction	”Run a lifecycle action on your offer: configure, certify, publish, unpublish, or delete a draft”	The offer itself: certify and publish move it toward customers, unpublish takes it back	Approve every call, and give publish and unpublish a named owner
Assets: getUploadUrl	”Get a secure URL to upload an asset (logo, screenshot, or document) or a package file”	Adds the file you upload	You choose the files; the agent handles references
Assets: uploadCredentials	”Upload credentials, such as OAuth or lead-management settings”	Stores the credentials	The agent gets a reference, never the secret

Approval lives in your MCP client. In Microsoft’s words, “Depending on your client’s approval settings, you approve each tool call before changes are submitted.” That makes approval a client setting, not a Partner Center one: a client set to run tools without asking can take an offer from draft to publish with nobody at your company approving it. Keep approval on for create, update, delete and doAction.

Unpublish is the removal to watch. The delete tool removes a draft sub-resource, doAction deletes a draft, and the Product Ingestion API deletes only “draft resources that haven’t been published before.” Of everything the agent can remove, unpublish is the one that can reach a published offer. Publish is the other call customers notice, because it puts your changes in front of them.

Microsoft’s publishing rules still apply. The Product Ingestion API under the server changes only the draft until you publish, sends every update to preview before live (“You can’t publish directly to live”), and Microsoft says offers “must be certified before being published.” The documented shortcut is the private audience: for a live product, syncing a plan’s private audience updates draft, preview and live together, “without requiring a publish.” Approve an audience change as if it were a publish.

Files and secrets travel as references. Assets and packages go up “through secure, time-limited URLs,” and uploaded credentials come back as “a safe reference”: Microsoft says “Your secret values are never exposed to the agent or the model.”

What do you need before an agent can use it?

A Partner Center account with the required role, access to the submission APIs, a supported client and a sign-in from your seller-associated tenant. In Microsoft’s words:

1. “A Partner Center account with the required role.” The MCP page doesn’t name the role.
2. “Access to the Microsoft Marketplace submission APIs.”
3. “An MCP-compatible client: Visual Studio Code or the GitHub Copilot CLI.”
4. A sign-in from the right tenant. On first use, your client prompts you “to sign in with Microsoft Entra ID and grant consent.” Use “an account that has a required Partner Center role in the seller-associated tenant,” which is the tenant linked to your Partner Center account. “Accounts from other tenants won’t work.”

Don’t borrow the direct API’s setup. If you’ve called the Product Ingestion API yourself, you added a Microsoft Entra application in Partner Center and assigned that application the Manager role. That role belongs to the application. The MCP server has a person sign in instead, so ask whoever administers your Partner Center account which role your own account holds.

Connecting is short in either client. In VS Code, Microsoft’s install button opens the editor, shows the server’s tools and asks you to Install and Trust them. In the GitHub Copilot CLI, start copilot, run /mcp add, enter the name marketplace-ingestion, the type HTTP and the endpoint URL, then press Ctrl+S to save.

How does it compare with a cross-cloud MCP server?

Microsoft’s server publishes and manages offers on Microsoft Marketplace only. A cross-cloud server such as Fours’ works across AWS, Azure and GCP Marketplace, and never gives an assistant you connect yourself a DELETE endpoint.

Server	What it covers	Sign-in	Deletes
Marketplace Ingestion MCP server (Microsoft)	Creating, validating, publishing and managing Microsoft Marketplace offers, through the Product Ingestion API and the Private offers API	Microsoft Entra ID, as an account with a required Partner Center role in the seller-associated tenant	delete removes draft sub-resources and doAction deletes a draft; doAction can also unpublish
Fours MCP server	Products, offers, entitlements, buyers, metering, co-sell and partners across AWS, Azure and GCP Marketplace: the public Fours API minus the seven DELETE endpoints, which a self-connected assistant never gets	OAuth 2.1 with PKCE and no API keys; at sign-in you set its access for each organization, never more than your role allows	None for an assistant you connect yourself; people delete in the Fours Console or through the REST API

They are separate servers with different jobs, and VS Code appears on both client lists. Both can change what buyers see. Fours’ catalog includes publishing a product and cancelling an offer, so the same rule carries over: approve every call that publishes or cancels. Fours’ setup, sign-in and full tool catalog are in the Fours MCP server documentation.

AWS has a first-party server of its own for partners, the AWS Partner Central agents MCP Server, which added OAuth sign-in through AWS Sign-In on August 20, 2026, for work such as co-sell engagements, AWS funding applications and AWS Marketplace seller setup.

Frequently asked questions

What is the Microsoft Marketplace MCP server?

Microsoft’s Marketplace Ingestion MCP server is a Model Context Protocol server that connects AI agents to the Partner Center Product Ingestion API and the Private offers API, so an agent can create, validate, publish and manage Microsoft Marketplace offers from natural-language requests.

What do you need to use Microsoft’s Marketplace MCP server?

A Partner Center account with the required role, access to the Microsoft Marketplace submission APIs, and an MCP-compatible client: Visual Studio Code or the GitHub Copilot CLI. You sign in with Microsoft Entra ID, using an account in the tenant linked to your Partner Center account.

Can an AI agent publish a Microsoft Marketplace offer?

Yes. The server’s doAction tool runs lifecycle actions on an offer: configure, certify, publish, unpublish, or delete a draft. Depending on your MCP client’s approval settings, you approve each tool call before changes are submitted, so keep approval on for every call that publishes.

Can the agent delete a published offer?

No. Microsoft’s API deletes only draft resources that have never been published, and the server’s delete tool removes a draft sub-resource. The removal an agent can make on a published offer is to unpublish it, through doAction, so give that call a named owner.

Does the agent see your credentials?

No. When you upload credentials, such as OAuth or lead-management settings, the server returns a safe reference, and Microsoft says your secret values are never exposed to the agent or the model. Assets and packages go up through secure, time-limited URLs.

How is it different from the Fours MCP server?

Microsoft’s server publishes and manages offers on Microsoft Marketplace only. The Fours MCP server works across AWS, Azure and GCP Marketplace and covers the public Fours API minus the seven DELETE endpoints, which an assistant you connect yourself never gets.

Takeaways

• Microsoft’s Marketplace Ingestion MCP server lets an agent create, validate, publish and manage offers through the Product Ingestion API and the Private offers API, for six offer types and five sales motions that Microsoft publishes as separate lists.
• The decisions stay where you put them: per-call approval in your MCP client, a sign-in from your seller-associated tenant, and references instead of secrets. Give publish and unpublish a named owner.
• Its removals work on drafts except unpublish, which can reach a published offer. A cross-cloud server such as Fours’ covers AWS, Azure and GCP Marketplace and never gives an assistant you connect yourself a DELETE endpoint.

The Fours MCP server puts products, offers, entitlements, buyers and co-sell across AWS, Azure and GCP Marketplace behind the assistant your team already uses, with every call scoped to the signed-in person’s organization and permissions. See what it covers on the Fours MCP server page.