CSP Customer Agreement | Microsoft Partner Contract Terms

CSP Customer Agreement: the missing link in the Microsoft chain

Microsoft, you, your client. It is a three-way relationship, and each leg of it needs its own paper.

Between Microsoft and you sits the Microsoft Partner Agreement. Between Microsoft and your client sits the Microsoft Customer Agreement (MCA). Between you and your client sits the Cloud Service Provider (CSP) Customer Agreement — and that is the one you own, the one you control, and the one most partners are running without.

What a CSP Customer Agreement does

It governs everything you sell your client: the Microsoft subscriptions you resell and the managed services you wrap around them. A well-built template flexes across your whole client base, adapting to each engagement's licensing needs and service mix through the order form rather than a redraft.

Who needs one

Microsoft Partners in the CSP programme reselling Azure, Dynamics or Microsoft 365
MSPs delivering managed services alongside Microsoft subscriptions
Any partner whose client relationship currently rests on an order form and goodwill

The clauses that matter most

1. The order form takes precedence

The order form carries the commercial detail: fees, licence subscriptions, service description, the managed services you offer and any SLA. Where documents conflict, the order form takes precedence, then the schedules, then the body of the agreement.

That ordering works in your favour. A change to fees further down the line means editing an order form, not redrafting a contract.

2. Your obligations

You commit to deliver whatever is in the order form — helpdesk support, training, fault response — plus the Microsoft subscriptions.

Watch the wording. You provide managed services with reasonable skill and care, and where you fall short you use commercially reasonable endeavours to remedy it. Never accept "best endeavours", "all endeavours" or "time is of the essence": each ratchets your commitment beyond what is reasonable, costs you resources, and can hand the client an excuse to terminate.

You should retain the right to use subcontractors without client consent. The client should not have the reverse right — they need your written consent to subcontract, assign or novate.

And you are responsible only for the security of your managed services.

3. Client obligations

Microsoft comes first: the client must sign the Microsoft Customer Agreement online before your agreement is signed. The MCA governs acceptable use of the subscriptions and online services.

Jurisdiction note — the MCA is regional

The Microsoft Customer Agreement is published in regional versions, with different governing law and dispute terms depending on where the customer is contracting — US customers, UK customers and Canadian customers do not sign identical documents. Microsoft's data protection terms also differ in what they commit to for each region, including data residency.

Your CSP Customer Agreement sits on top of whichever version the client signed, so make sure your agreement does not contradict it and that the flow-down obligations you impose match the version in force in that market.

Beyond that, the client provides reasonable assistance, workspace and information — relevant when you need access to their hardware, software or credentials to fix a fault. The agreement also puts a duty on them not to introduce viruses or share the services with third parties, and to comply with relevant law and regulation. That last point protects you when you need to suspend or modify services to stay compliant.

4. Delays

Delays are expensive and usually client-side. Two protections work together:

An obligation on the client to carry out its obligations in a timely and efficient manner, so delay is a breach you can point to.
Liquidated damages: cancelling or delaying a scheduled date between 14 and 7 days out costs 50% of the fees for that period; inside 7 days, 100%.

Where the client delays, you can adjust the timetable and delivery dates accordingly.

5. Subscriptions

Whether you resell Azure, Dynamics or Microsoft 365, the client must report its subscription usage to you monthly. This matters twice over: for your own auditing, and for complying with Microsoft's consumption terms on Azure. You should also be able to install a barrier to stop the client from running past any usage cap.

6. Payment terms

Fees are in the order form. Payment is due 30 days from invoice, with interest on anything unpaid after that.

You should be able to raise prices annually, or in line with Microsoft's own licence fee increases, on 30 days' notice. Sales tax is excluded from fees and added to the invoice. The client cannot withhold payment.

Jurisdiction note — interest, tax and price rises

UK — 30 days reflects the Prompt Payment Code; a common contractual rate is 4% above the Bank of England base rate, against a statutory default of 8% above base under the Late Payment of Commercial Debts (Interest) Act 1998. Fees exclude VAT.

US — No general federal prompt payment rule for private contracts. Interest is contractual, subject to state usury caps. Fees exclude state and local sales tax, and the taxability of cloud subscriptions and managed services varies by state — worth confirming before you quote.

Canada — Under s.4 of the Interest Act, interest expressed for a period shorter than a year must state the equivalent annual rate or it is capped at 5% per annum. Express your rate as an annual figure. Fees exclude GST/HST, plus QST in Quebec.

The right to pass on Microsoft's price increases matters everywhere, and matters more where currency movement sits between Microsoft's pricing and your invoice.

7. Intellectual property

You own all IP rights in your managed services. You give the client no indemnity for third-party IP infringement. The client must tell you if they know of or suspect a claim. You decide whether to defend; you control any litigation, and the client provides reasonable assistance.

8. Confidentiality

Signing the CSP Customer Agreement ends the earlier contracts between the parties — including the NDA used during negotiations. The agreement therefore carries its own confidentiality obligations on both sides, typically continuing for three years after termination.

9. Liability

Limiting liability is a first-order priority here, and it is done in layers. You do not guarantee the managed services will run at 100%, 24/7, and you cannot control data flow between your systems and the internet — which protects you from events outside your control and minor technical faults.

Where liability can be capped, it is capped at 100% of the fees in the past 12 months, rising to 200% for data protection breaches. Death or personal injury caused by negligence, fraud, and other liabilities that cannot be limited by law remain uncapped.

Jurisdiction note — caps and data protection exposure

UK — Reasonableness under the Unfair Contract Terms Act 1977. The elevated data protection sub-cap reflects UK GDPR exposure, where fines reach the higher of £17.5m or 4% of global turnover.

US — Unconscionability and UCC §2-719. Data exposure is driven by 50 state breach notification regimes, state privacy statutes, and class action risk rather than a single regulator — notification and remediation costs are often the larger number.

Canada — The Tercon (2010 SCC 4) framework. PIPEDA penalties are lower than UK GDPR's, but Quebec's Law 25 introduced administrative monetary penalties on a comparable scale.

10. Termination

The engagement runs for the initial period in the order form, then auto-renews annually. Both parties give 60 days' notice, in line with the MCA.

A material breach gives the other party 30 days to remedy before termination. You can terminate immediately if payment is more than 10 days late without written notice, or if the client repeatedly fails its subscription reporting obligation.

11. Governing law and jurisdiction

Jurisdiction note

UK — English law with exclusive jurisdiction of the English courts.

US — Name a state's law and venue, and decide deliberately on arbitration and jury trial waiver.

Canada — Name the province. For Quebec clients, expect to provide a French-language version of customer-facing documents.

In all three, make sure your choice does not sit awkwardly against the governing law in the regional Microsoft Customer Agreement the client has already signed.

Frequently asked questions

Isn't the Microsoft Customer Agreement enough? No. The MCA is between Microsoft and your client. It says nothing about your fees, your services, your SLA or your liability.

Do I need a separate CSP agreement for each client? No — one template, with the commercial variables handled in the order form for each engagement.

What if the client goes over their Azure consumption cap? Your agreement should let you invoke a usage barrier and should require monthly subscription reporting so you see it coming.

Can I put my prices up when Microsoft puts theirs up? Yes, if the agreement says so. Annual increases and increases in line with Microsoft licence fee changes, both on 30 days' notice.

Does the same CSP agreement work for US, UK and Canadian clients? The commercial structure does. What changes in the regional version of the Microsoft Customer Agreement your client signs, the governing law and venue, sales tax treatment, how you express late payment interest, and the data protection terms behind your liability cap?

How Cloud Contracts 365 helps

Cloud Contracts 365 was built with Microsoft Partners in mind. Build your CSP Customer Agreement from a guided questionnaire — order form precedence, subscription reporting, NCE terms and liability caps included — then issue a new order form per client instead of a new contract.

Review anything a client sends back, e-sign it, and let renewal reminders handle that 60-day notice window.