When a Buyer's Private Marketplace Blocks Your Deal

A private marketplace is a buyer’s curated catalog of the cloud marketplace products its users are allowed to procure. Private marketplace approval is the buyer’s administrator adding your product to it. When procurement says your product isn’t approved, that step, not your offer, is what the deal is waiting on.

---

Acme has a private offer out to Umbrella, terms agreed, expiring at the end of the quarter. Then Umbrella’s procurement lead writes back: Acme’s product isn’t approved in their private marketplace, and nobody can buy it until it is. On AWS, the buyer may see only an error saying the product is not available in their private catalog.

The offer isn’t broken. A private marketplace is a control the buyer runs, and each cloud builds it differently:

• On AWS, the administrator approves your product from their own account, so the offer has to reach that account too.
• On Microsoft, a rule approves every private offer automatically. It’s the default in a new private marketplace, but the buyer can switch it off.
• On Google Cloud, users can’t request a product with private pricing, so an administrator has to add it directly.

Where the gate sits in the rest of the purchase, from billing accounts to roles, is in how enterprise buyers buy through a marketplace.

What does a buyer’s private marketplace block?

It stops governed users from subscribing to, purchasing or deploying products the buyer’s administrators haven’t approved, though not from finding you. Each cloud draws the line in its own words:

• AWS applies experiences to the organization, an organizational unit (OU) or one account through AWS Organizations, and “will only block new subscriptions or changes to existing subscriptions to products that are not approved in the experience that is governing the user.” Products whose EULAs fall under the AWS Customer Agreement sit outside it.
• Microsoft governs a whole Azure tenant: “Only offers approved by the private Microsoft Marketplace administrator can be deployed inside the Azure tenant.” Microsoft’s own solutions and endorsed Linux distributions are always approved.
• Google Cloud shares collections with the organization, folders or projects. Users “can only access the products in the collections that you’ve shared with them, and they can’t deploy products that you haven’t shared with them.” Since March 26, 2025, it can block new API deployments of unapproved third-party GKE apps and containers, Cloud Run containers, virtual image disks, Vertex AI models and BigQuery datasets, by default for organizations that first turned it on after that date. Users “can still choose to navigate to and access the public marketplace.”

Existing customers aren’t exempt. AWS leaves current subscriptions running, but under a Live experience “all new subscriptions or renewals are limited to the products approved in the experience,” so a renewal or an amendment needs your product approved too.

How does approval work on AWS, Microsoft, and Google Cloud?

Each cloud puts the approval in a different place and gives the seller a different job.

	AWS	Microsoft	Google Cloud
The gate	Private Marketplace experiences for the organization, an OU or an account	Private Microsoft Marketplace, per Azure tenant, with collections scoped to subscriptions	Google Cloud Private Marketplace, with collections shared with the organization, folders or projects
Who runs it	The management account, or the delegated administrator account	A user with the Marketplace admin role, assigned by the tenant’s Global administrator	A Commerce Organization Governance Admin, at the organization level
What it blocks	New subscriptions, renewals and changes to subscriptions for unapproved products	Purchase and deployment of plans not approved for the chosen subscription	Access to unshared products, and API deployments of the types above
Approved without asking	Approval is per product, in each experience	Microsoft’s own solutions, and every private offer and private plan while the “Enable private products” rule is on, the default in a new private marketplace	Products the organization was billed for in the past 24 months start in the default collection
How the buyer asks	Request product, if product procurement requests are enabled (on by default)	Request to add, with the plans and a justification	Request product, if Product Requests is on (off by default), but never for a product with private pricing
What the seller does	Put the administrator’s account on the offer, before release	Ask whether the rule covers the purchasing subscription	Send the administrator your product details page URL, and the project to share it with

On AWS, why must the administrator’s account be on the offer?

Because the administrator approves your product from their own account, and AWS shows a private offer only to the accounts it’s extended to. The seller guide makes it a rule: “If the buyer account for your private offer is managed through a private marketplace, you must include both the buyer’s account and the account that includes their private marketplace administrator in the offer.” For products that aren’t publicly listed, the buyer guide gives the reason: the buyer “can only subscribe if your Private Marketplace administrator approves the product in your experience.”

• Ask which account. AWS restricts Private Marketplace administration “to the organization’s management account or a member account that is a delegated administrator for the service.”
• Settle it before release. “BuyerAccounts can’t be added after the offer is released,” so an offer sent without the administrator’s account has to be replaced. Why a buyer can’t accept an AWS private offer covers the clone-and-cancel route.
• Count it. The administrator’s account uses one of the offer’s buyer-account slots; AWS private offers for multiple buyer accounts covers the limit.

With both accounts on the offer, the administrator approves the product directly, or the champion chooses Request product on the red banner AWS shows for an unapproved product, if requests are enabled. The request carries a reason and an optional purchase order number, and an approval lets every user in that experience subscribe.

Approval belongs to an experience: AWS applies “the experience that is Live and closest to an account in the organization hierarchy,” and that experience doesn’t inherit approvals from above it. Ask for approval in the experience that governs the accepting account.

In Fours, the Buyer(s) field on an AWS private offer takes one or multiple 12-digit AWS account IDs, so the administrator’s account goes in beside the buyer’s. For an offer already sent without it, the route Fours’ docs give for a wrong account applies: clone the offer, fix the accounts, send the new offer and cancel the previous one.

On Microsoft, when is a private offer approved automatically?

When the collection covering the buyer’s purchasing subscription has the “Enable private products” rule on. The rule will “approve all private offers and private plans for your organization.” Microsoft recommends it and calls it “the default setting in any new private marketplace,” but the buyer can opt out “at any time,” so check two things:

• Is the rule on? Rules are set per collection. A second rule, “Enable Microsoft standard contract products,” approves everything sold under the Microsoft standard contract.
• Does it cover the right subscription? Collections are scoped to subscriptions, and Microsoft checks at purchase, after the offer is accepted: a plan or subscription that isn’t approved gets a banner and a disabled Create button.

From that banner, the buyer selects Request to add, picks the plans and adds a justification. A Marketplace admin, whose role the tenant’s Global administrator assigns, approves it into a collection, and then “the solution is available for purchase.”

Which Microsoft billing policy can still block a paid offer?

The Marketplace purchase policy on the buyer’s Enterprise Agreement enrollment or Microsoft Customer Agreement billing profile, which is separate from the private marketplace. An approved plan still can’t be bought with a subscription whose policy allows only free software.

Agreement	Who sets it	Settings	A paid private offer needs
Enterprise Agreement	Enterprise administrators, for every subscription in the enrollment	Off, On, or Free/BYOL SKUs only	On
Microsoft Customer Agreement	Billing administrators, per billing profile	Free + Paid, Free, or No	Free + Paid

Under “Free/BYOL SKUs only,” “users can only deploy free and BYOL (Bring Your Own License) applications.” If your plan is approved and the purchase still fails, look here; the fix belongs to the buyer’s billing administrators.

On Google Cloud, why can’t the champion just request your product?

Because Google doesn’t let users request some products, “such as products with private pricing,” so a privately priced deal needs an administrator to add your product to a collection directly. Product Requests is off by default. When it’s on, a user’s Request product creates an access request, which a Commerce Organization Governance Admin approves into a collection.

For a product with private pricing, go straight to the administrator. They add a product by entering “the URL of the product’s product details page,” so send that URL with the offer, and check two things:

• The project. A user’s “membership in an organization, folder, or project determines which products are available,” so ask which project the buyer will use and have the collection shared with it.
• What’s already approved. The default collection starts with Marketplace products the organization has been billed for in the past 24 months, but not custom products that aren’t listed publicly. An existing customer may already have you.

That users can still reach the public marketplace doesn’t make approval optional: it’s what the buyer’s procurement team asked for.

What should you ask the champion before you send the offer?

Three questions, asked when you scope the offer rather than when it stalls; the answers decide which accounts go on it.

1. Is the account, tenant or project that will buy governed by a private marketplace? On AWS, Your Marketplace under Private Marketplace in the AWS Marketplace console names the governing experience, or says “You’re not being governed by a Private Marketplace experience.” On Microsoft, approved partner offers carry a green Approved badge. On Google Cloud, a governed project opens on the private marketplace.
2. Will our product be approved automatically, and if not, can you request it? On Microsoft, ask whether the “Enable private products” rule covers the purchasing subscription. On AWS, Your Marketplace shows whether Product procurement requests is Enabled. On Google Cloud, ask whether Product Requests is on; a privately priced product can’t be requested.
3. Who is the administrator? On AWS, get the 12-digit ID of the management or delegated administrator account for the offer. On Microsoft, find the Marketplace admin, and whoever owns the purchase policy. On Google Cloud, find the Commerce Organization Governance Admin, and the project the buyer will use.

Then set the offer’s expiry with the approval inside it: the administrator’s queue runs on the buyer’s calendar, not your quarter.

Frequently asked questions

What is private marketplace approval?

Private marketplace approval is a buyer’s administrator adding your product to the curated catalog their organization is allowed to procure from. Only the buyer can approve it. The seller’s part is making approval possible, such as adding the administrator’s account to an AWS private offer.

Who approves a product in a buyer’s private marketplace?

On AWS, an administrator in the organization’s management account or in a delegated administrator account. On Microsoft, a user with the Marketplace admin role, assigned by the tenant’s Global administrator. On Google Cloud, a Commerce Organization Governance Admin.

Why does an AWS private offer need the administrator’s account?

The administrator approves your product from their own account, and AWS shows a private offer only to the accounts it’s extended to. AWS requires both the buyer’s account and the administrator’s account on the offer, and accounts can’t be added after release.

Are private offers approved automatically in private Microsoft Marketplace?

Only when the “Enable private products” rule is on in the collection covering the purchasing subscription. Microsoft makes it the default in any new private marketplace, but buyers can opt out. Then the buyer selects “Request to add” and an admin approves the plan.

Can a Google Cloud user request a product with private pricing?

No. Google says users can’t request certain types of products, “such as products with private pricing, or Google products.” An administrator has to add the product to a collection directly, using the URL of its product details page.

Does a private marketplace block subscriptions a buyer already has?

AWS says usage of existing subscriptions isn’t blocked, and Google Cloud says existing deployments aren’t affected. But AWS limits new subscriptions and renewals to approved products, so renewing or amending an existing customer’s agreement needs your product approved.

Takeaways

• A private marketplace is the buyer’s gate, and only their administrator opens it. Ask about it when you scope the offer.
• On AWS, put the administrator’s account on the offer before release, and get approval in the experience that governs the accepting account.
• On Microsoft, confirm the “Enable private products” rule covers the purchasing subscription, then check the Marketplace purchase policy.
• On Google Cloud, a privately priced product can’t be requested, so send the administrator your product details page URL.
• Existing customers aren’t exempt: AWS limits renewals to approved products too.

Fours builds each AWS private offer for one buyer account or several, so the private marketplace administrator’s account goes on with the buyer’s before release. See how offers move from CRM record to acceptance in Fours’ private offer management.