New Microsoft Partner Security requirements & Partner Agreement (MPA)

1. Microsoft Partner Security requirements

As we step into FY20, it's clear that Microsoft will be putting a lot of emphasis on “SECURITY” for Cloud solution provider (CSP) program. This first segment of the blog will take you through the latest security requirements defined for all indirect resellers.

Note: Click on the links/URL provided throughout the blog which will give you detailed information on each topic

Mandatory Multi-factor authentication requirement for CSP Indirect Resellers: (Action by August 1, 2019)

All indirect resellers enrolled in the CSP program are required to activate MFA for every user in partner tenant. The activation can be performed by leveraging two baseline policies, one for the admins and for end-user protection which is described as following:

MFA for admins: To secure the identities of the admin in the privileged role, a baseline policy needs to be activated for admins, which would result in these users being prompted with a second-factor challenge each time they perform a user login. More details can be found here: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-baseline-protect-administrators

MFA for end users: The security requirement is not limited to the admins but extends to the end users, because these users can be a potential target to security vulnerabilities. The end user will be challenged for the second factor only in the scenario where a sign in risk is detected. More details can be found here: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-baseline-protect-end-users

The best part about this is the fact that a baseline policy would be available for all partners free of cost, the only action required is to just activate it on the tenant by going to the conditional access tab in Azure portal or admin center.

To find out more information on the above please check out this link: https://rhi.pe/vh

To understand more about what the new partner security requirements for indirect reseller are, please visit the following resources below:

Partner security requirements implementation step-by-step guide
Partner security requirements frequently asked questions
Partner Center Security Guidance community group
Office hours with technical experts (starting June 27)
Partner security requirements resources gallery
Microsoft MFA rollout materials

2. New Microsoft partner agreement (MPA)

The new Microsoft Partner Agreement (MPA) is almost here, to give the partners more transparency around the regulatory requirements. This will replace the existing Indirect Reseller Terms that you have executed with rhipe effective as of August 31, 2019

The new MPA would be available for preview on July 31, 2019, in Partner centre (Or Partner Center for US English). Your existing Indirect Reseller Terms with rhipe will expire on August 31, 2019. You will be able to sign the new MPA from September 1, 2019 - January 31, 2020 in the Partner Center.

Note that even though the Indirect Reseller Terms through rhipe would expire on August 31, 2019, you can continue to transact under the old terms until January 31, 2020, which would give you enough time to sign the new MPA. However, if the MPA is not signed by January 31, 2020, you will not be able to add new or edit existing subscriptions under the Microsoft CSP Program after that. ]

More information can be found here @ https://rhi.pe/vh

To make things more easier please check the table below:

Important dates	Activity	Action required
July 31, 2019	New MPA available for preview in Partner center.	Go through the new MPA in partner center.
August 31, 2019	The old reseller agreement, ie Indirect Reseller Terms, expires.
September 1, 2019	Microsoft Partner Agreement available for signing in Partner Center	Partner can sign the new agreement or continue with the old one until January 31, 2020
January 31, 2020	After January 31, 2020, the old contract can’t be used for CSP transaction.	The partner is required to sign the new contract before the given date, to avoid disruption of services.