Replacing WeTransact's managed integration with the open-source Microsoft SaaS Accelerator — what you keep, what you lose, and what it really costs.
WeTransact's managed integration sits between your Microsoft Marketplace listing and your customers. If you remove it, six pieces stop working — and you take responsibility for rebuilding them.
SaaS Fulfillment API v2 — the contract that turns a Marketplace purchase into an active subscription.
Branded activation page and Microsoft Entra ID single sign-on so the buyer never sees a broken redirect.
The 6 lifecycle events Microsoft fires — activated, suspended, reinstated, plan changed, quantity changed, unsubscribed.
The portal where you see every order, plan, customer, MRR, and payout — without opening Partner Center.
Usage events posted to the Marketplace metering API for consumption-priced plans.
Direct, CSP, and Multiparty Private Offers (MPPO) — created and tracked from a single dashboard.
Your Partner Center account, your offers, your customers, your historical sales data — none of that changes when you switch off WeTransact. You own everything you ever published. This guide is only about replacing the integration layer.
The SaaS Accelerator is a deployment template, not a product. It rebuilds the plumbing — and nothing else. Below is the honest list of what disappears the moment you cut over.
WeTransact handles every lifecycle webhook, retries failures, and activates subscriptions inside the 30-day Microsoft window. Self-hosted, your App Service has to be online and correct on every retry.
No Direct, CSP, or Multiparty Private Offer creation flow. You go back to Partner Center's manual UI — 15+ steps per offer, no templates, no co-sell linkage.
No financial reporting. No invoices. No payout reconciliation. The Accelerator admin portal shows raw rows from a SQL table — no MRR, no churn, no CFO-ready exports.
Zero GTM tooling. No MACC consumption data, no Microsoft AE contact discovery, no deal registration, no buyer-intent signals.
No HubSpot, no Salesforce, no Pipedrive sync. Marketplace deals don't flow into your CRM. Finance reconciles by hand.
The Accelerator is a community-supported open-source repo. Microsoft does not own it. When the Fulfillment API or webhook contract changes, somebody has to read the changelog, ship the fix, and redeploy.
Without publisher verification on your Entra ID app registration, customers see an "unverified app" warning during SSO. Verification takes 1–3 weeks and requires legal docs.
Realistically: 5–10 hours per month of monitoring, secret rotation, and incident response. At a loaded engineering rate, that's before anything goes wrong.
The Azure bill is the easy number. The expensive number is your engineers — and that's the one most TCO comparisons forget. Honest math, in euros, per month.
SaaS Accelerator deployment (predictable)
Your engineering team — at loaded
Pricing source: wetransact.io/pricing-wetransact
Below is the full SaaS Accelerator deployment path — written so a reasonably experienced .NET / Azure engineer can follow it end-to-end. Read every prerequisite first; fixing them mid-deploy is painful.
Heads up: the SaaS Accelerator is community-supported on GitHub. It is not an officially supported Microsoft product. Microsoft will help you with Partner Center; they will not help you debug your fork.
View Azure/Commercial-Marketplace-SaaS-Accelerator
Owner role. New resource group recommended.
Permission to create app registrations.
Marketplace publisher with at least one SaaS offer.
Required to grant the multi-tenant app SSO permissions.
You will read C#, debug PowerShell, and edit Razor pages.
Verified in Partner Center — required to be paid by Microsoft.
Each step assumes the previous one finished cleanly. Don't skip ahead — the cutover step (4) is irreversible without a rollback.
Create two Microsoft Entra ID app registrations:
Run the deployment script from Azure Cloud Shell (PowerShell). Total deploy time is ~8–15 minutes. The script provisions App Services, SQL, Key Vault, Application Insights, and Managed Identity.
# Clone the supported release tag, not main git clone https://github.com/Azure/Commercial-Marketplace-SaaS-Accelerator.git -b 8.2.1 --depth 1 cd ./Commercial-Marketplace-SaaS-Accelerator/deployment # Deploy .\Deploy.ps1 ` -WebAppNamePrefix "UNIQUE-PREFIX" ` -ResourceGroupForDeployment "RG-NAME" ` -PublisherAdminUsers "admin@domain.com" ` -TenantID "TENANT-ID" ` -AzureSubscriptionID "SUB-ID" ` -Location "YOUR-PREFERRED-REGION"
When Deploy.ps1 finishes, copy these four values — you'll paste them into Partner Center in the next step.
| Field | Where to get it |
|---|---|
| Landing Page URL | https://PREFIX-portal.azurewebsites.net/ |
| Webhook URL | https://PREFIX-portal.azurewebsites.net/api/AzureWebhook |
| Tenant ID | From Entra ID overview blade |
| Application ID | Multi-tenant app registration created in Step 01 |
Open every SaaS offer in Partner Center → Technical Configuration → paste the four values from Step 03 → Publish. The moment the publish succeeds, every new Marketplace purchase routes to your Azure deployment instead of WeTransact. Existing active subscriptions continue under their original webhook URL until they renew or you migrate them manually.
Create a $0 / Free private plan, restrict it to a test tenant, and walk through the full purchase cycle: land on your branded page, sign in with SSO, accept the subscription, see it activate in the admin portal, then unsubscribe. If any step shows a yellow Microsoft warning or a 500 — stop and fix before opening up paid plans.
The default Razor page is intentionally generic. You'll want to add: your branding, an SSO sign-in button wired to the multi-tenant app, error and pending states, and outbound notifications via Logic Apps (subscription activated, plan changed, unsubscribed). Email out-of-the-box: none.
Submit your multi-tenant app registration for publisher verification. Until this is approved, customers see an "unverified app" warning during SSO. Approval takes 1–3 weeks and requires legal documentation. Open the request the same day you cut over — don't wait.
Run all seven scenarios. Every row needs a green pass before you mark the migration complete.
| Scenario | Expected behaviour | Status |
|---|---|---|
| Free trial activation | Lands, SSOs, activates within 30s | Required ✓ |
| Paid plan purchase | Activates, charge appears in payout report | Required ✓ |
| Plan change (upgrade) | Webhook fires, plan updates in DB | Required ✓ |
| Quantity change | Seat count updates, prorated | Required ✓ |
| Suspension (failed payment) | Subscription marked suspended, customer notified | Required ✓ |
| Reinstatement | Subscription returns to active | Required ✓ |
| Unsubscribe | Status flips, customer access revoked | Required ✓ |
Once you cut over, every one of these is on your engineering team. There is no support contract behind them.
HTTP 5xx, response time, restarts. The portal is the customer's first impression.
DTU saturation, blocking queries, backup verification, growth.
Every dropped event is a lost subscription. Alert on any 4xx/5xx from the AzureWebhook endpoint.
App Service managed certs auto-renew, custom domains do not. Calendar reminder, two weeks out.
They expire — usually quietly. The day they do, every new SSO sign-in fails. Rotate on a schedule.
The rollback path is honest and short. The checklist is what we'd run through with you on a call before any cutover.
We built this guide because we'd rather you read the truth than hear it from a thread on GitHub. If after all this you still want to self-host — we'll help you cut over. If not, WeLaunch is and includes everything above.