Your Azure Bill Is Higher Because Your Partner Isn't Managing Anything

In this article

• What Partner Earned Credit Actually Is
• What PEC Looks Like in Practice
• Why Most Enterprises Don’t Get This Benefit
• Microsoft Eligibility vs What Your Partner Should Actually Do
• What Microsoft checks
• What a good partner does in exchange
• How to Check If Your Current Setup Earns PEC
• The Conversation You Should Have With Your Partner

In short: Microsoft gives CSP partners a credit (often ~15%) on eligible Azure consumption when the partner has the right RBAC access and operational role. Most enterprises on CSP never see this benefit because the access isn’t configured correctly. Checking takes 30 minutes. Fixing it takes days, not months.

There may be a commercial lever in your Azure setup that many customers overlook: Partner Earned Credit. It doesn’t replace reserved instances, right-sizing, or governance. But if your Azure runs through a CSP partner and the relationship isn’t configured correctly, you’re leaving real money on the table.

Microsoft runs a programme called Partner Earned Credit (PEC). When a partner has the right access and operational role in a customer’s Azure environment, Microsoft reduces the partner’s net cost on eligible Azure Plan consumption. On many eligible meters, that reduction is often around 15%, though the applicable rate is determined in Partner Center and not all Azure spend qualifies.

That benefit belongs to the partner commercially. Whether customers see it depends on the commercial model: some partners pass it through as reduced Azure pricing, some use it to fund managed services, and some simply keep it as margin. Getting clarity on this is part of the conversation.

Most enterprises we talk to have never heard of PEC. Their Azure partner hasn’t mentioned it. And the reason is usually that the partner isn’t set up to earn it in the first place.

What Partner Earned Credit Actually Is

PEC is Microsoft’s way of rewarding partners who do more than resell Azure subscriptions. The logic from Microsoft’s side: if a partner is actively managing a customer’s Azure environment, that customer is more likely to stay on Azure and have a better experience. Microsoft is willing to reduce the partner’s net Azure cost for making that happen.

PEC applies to eligible Azure consumption under the Azure Plan (the billing model used in the Cloud Solution Provider programme). It’s calculated daily and reflected in the partner’s net charges and reconciliation files rather than appearing as a separate invoice credit line.

What is typically eligible: compute, storage, networking, databases, App Services, AKS clusters, Azure Firewall, Log Analytics, and most other consumption-based Azure services on eligible meters.

What is excluded: Azure Reservations (the discount is already baked in), Azure Savings Plans, Spot VMs, third-party Marketplace purchases, and telco overage charges. These are excluded because Microsoft already offers a discount mechanism or they involve third-party margins.

This exclusion list matters. In a mature estate where 30-40% of compute is covered by reservations or savings plans, the PEC-eligible base is significantly lower than total Azure spend.

What PEC Looks Like in Practice

For a small Azure footprint, PEC is a nice-to-have. At enterprise scale, it changes the economics.

The maths is not as simple as “15% of total spend.” Here is a realistic blended example:

	Monthly
Total Azure spend	€200,000
Reservations (excluded)	-€70,000
Savings plans (excluded)	-€15,000
Marketplace (excluded)	-€10,000
PEC-eligible base	€105,000
PEC at ~15%	~€15,750/month
Annualised	~€189,000/year

Still significant, but roughly half of what a gross-spend calculation would suggest.

For enterprises spending €100K or more per month, even the blended PEC value is often enough to fund a structured cost review, governance maintenance, and security posture management. Whether it comes to you as lower Azure pricing or as funded services depends on your agreement with the partner.

Why Most Enterprises Don’t Get This Benefit

There are four common reasons we see when we review partner setups.

The first is the agreement type. PEC only applies to Azure subscriptions under the Azure Plan in the CSP model. If your organisation is on a legacy Enterprise Agreement (EA) or a direct Microsoft Customer Agreement (MCA) without a partner, PEC doesn’t exist for you. Many large enterprises signed EAs years ago and never revisited the commercial model.

Second, your partner might be the “partner of record” on your Azure subscriptions, but that’s not enough. PEC requires that the partner has active RBAC roles on the Azure subscriptions they manage. Microsoft checks for roles like Owner, Contributor, or User Access Administrator that demonstrate the partner is operating in the environment, not just billing for it.

Third, the access paths are often misconfigured. There are three valid options for PEC eligibility: Admin on Behalf Of (AOBO, the default CSP mechanism), Azure Lighthouse (more granular, multi-tenant management), and individually assigned user or service principal accounts with the correct partner association (PAL). Many partners set up the billing relationship but skip the operational access because the customer’s security team pushes back, or nobody realises it’s needed.

Finally, some partners are pure resellers. They sell Azure, add a margin, send invoices, and that’s the extent of the relationship. Microsoft designed PEC to distinguish between partners who add operational value and those who just pass through billing.

The common thread: in all four cases, the fix is configuration and access, not architecture or migration. The Azure environment doesn’t change. The billing relationship does.

Microsoft Eligibility vs What Your Partner Should Actually Do

There’s an important distinction between what Microsoft checks for PEC eligibility and what a competent partner should be doing with that access.

What Microsoft checks

• Active Azure Plan/CSP agreement
• Eligible RBAC role on subscription, resource group, or resource scope
• Correct partner association (AOBO, Lighthouse, or PAL-linked access)
• Daily verification against eligible consumption meters

What a good partner does in exchange

• Regular cost reviews and optimisation recommendations
• RBAC and identity governance (least-privilege, PIM configuration)
• Azure Policy management (tagging, SKU restrictions, diagnostic settings)
• Monitoring and alerting configuration (Azure Monitor, action groups, workbooks)
• Security posture management (Defender for Cloud, Secure Score, NSG reviews)
• Patching cadence for IaaS workloads

If you’ve built Azure Landing Zones, most of these activities are core pillars that need ongoing care.

None of this is exotic. It’s the basic operational hygiene that every Azure environment needs. The difference is whether someone is actually doing it in a structured, recurring way.

How to Check If Your Current Setup Earns PEC

If you’re on a CSP agreement, you can ask your partner directly whether they’re earning PEC on your subscriptions. If they hesitate or don’t know what PEC is, that tells you something.

For a more concrete check, look at three things.

First, open the Azure portal and go to Cost Management. Check the billing scope. If your subscriptions are under an Azure Plan, you’re on the right billing model. If they’re under an Enterprise Agreement, PEC doesn’t apply.

Second, review RBAC assignments on your subscriptions. Does your partner’s tenant have active role assignments (Owner, Contributor, or similar)? If there are no role assignments from your partner’s directory, they have no operational access. You can check this under Access Control (IAM) on each subscription.

Third, ask your partner for a reconciliation extract or Cost Management view showing where PartnerEarnedCreditApplied is true and what PEC percentage was applied. Microsoft surfaces this in the daily rated usage reconciliation file and in Cost Management. If PEC is at 0% across all subscriptions, the access isn’t configured correctly.

The Conversation You Should Have With Your Partner

If your partner isn’t earning PEC, the first step is understanding why. Is it a billing model issue (EA vs CSP)? Is it a security concern that blocked RBAC access? Is it simply that nobody set it up?

Once the root cause is clear, the fix is usually straightforward. Setting up AOBO, Azure Lighthouse, or PAL-linked access, assigning the right RBAC roles, and establishing a minimum set of operational activities takes days, not months. The commercial conversation about how PEC value is shared (direct pass-through, reduced service fees, or funded managed services) takes a single meeting.

For enterprises spending €100K or more per month on Azure, getting PEC right is one of the highest-ROI conversations you can have with your partner.

Microsoft docs: Partner Earned Credit overview · Azure Lighthouse for delegated management · Azure RBAC built-in roles · Reconciliation files