cloud apps – Natpoint

Microsoft has launched a single unified Marketplace bringing together Azure Marketplace and AppSource, offering a central location for cloud services and AI applications integrated directly into the Microsoft ecosystem.

One Destination For AI And Cloud Procurement

On 25 September 2025, Microsoft announced the launch of Microsoft Marketplace, a new platform designed to simplify the way organisations discover, purchase, and deploy software across Microsoft’s cloud services. By combining the previously separate Azure Marketplace and Microsoft AppSource into a single platform, the company aims to give customers a more seamless experience for accessing both Microsoft-built and third-party solutions.

Trusted Source

According to Microsoft, the new Marketplace serves as a “trusted source for cloud solutions, AI apps and agents” that integrates directly with Microsoft Cloud offerings including Azure, Microsoft 365, Dynamics 365, Power Platform, and Microsoft Security.

Supports “Frontier Firms” Idea

The catalogue includes tens of thousands of listings across categories such as data and analytics, productivity and collaboration, and a range of industry-specific solutions. Microsoft says the launch supports its vision of enabling more organisations to become “Frontier Firms”, which is a term it uses to describe businesses that blend AI-driven tools with traditional work to accelerate innovation.

A Focus On AI Agents And Rapid Deployment

A key new component of the Microsoft Marketplace is the AI Apps and Agents category. This area of the Marketplace features more than 3,000 AI tools, including well-known Microsoft offerings like Microsoft 365 Copilot and Azure AI Foundry, alongside partner-developed applications. These agents are designed to automate tasks, enhance decision-making, and unlock operational efficiency across business functions.

Microsoft actually claims these tools can now be provisioned and deployed in under a minute! For example, Siemens, one of the launch partners, stated that it reduced AI app configuration times from 20 minutes to just 1 minute per instance using the Marketplace. The company also reported an eightfold increase in customer adoption through the new platform.

To make it easier for businesses to integrate AI into existing workflows, the new Marketplace also embeds selected solutions directly within Microsoft products. For example, Copilot agents are now accessible within the Microsoft 365 experience via an integrated Agent Store, while Teams apps, Azure models, and other tools are available in context where users work.

Streamlining Governance And Spending Management

Microsoft has positioned the Marketplace as a governance-friendly solution. This appears to be because all deployments are managed through a customer’s existing Microsoft Cloud environment and, therefore, IT teams can retain control over access, security, and compliance. Applications and agents installed from the Marketplace follow the organisation’s configured policies, helping to ensure consistency across teams and departments.

This integrated experience may be particularly important for organisations with pre-agreed Microsoft Azure Consumption Commitments (MACCs). Microsoft confirmed that any eligible purchases made through the Marketplace continue to count towards these commitments, allowing finance and procurement teams to optimise spending without risking overspend or compliance issues.

New Commercial Routes For Partners And ISVs

For Microsoft’s partner ecosystem, the Marketplace also opens new sales and distribution channels. For example, the company has expanded integration with major distributors such as Arrow, Crayon, Ingram Micro, Pax8 and TD SYNNEX, enabling them to embed Microsoft Marketplace listings into their own offerings.

Microsoft has also introduced a new feature called “resale enabled offers”, currently in private preview, which allows independent software vendors (ISVs) to authorise their partners to sell Marketplace listings on their behalf through private offers. This model aims to support co-selling strategies and increase the reach of third-party solutions.

According to Nicole Dezen, Microsoft’s Chief Partner Officer, more than six million people visit Microsoft Marketplace every month, and the number of customers purchasing AI products through the platform has recently doubled.

Strategic Context And Timing

The launch of the unified Marketplace is really part of Microsoft’s wider commercial strategy to embed AI into the core of enterprise operations, reduce procurement complexity, and support channel growth. It also arrives at a time when Microsoft is restructuring internally to put greater emphasis on AI execution and developer platforms.

By consolidating its marketplaces, Microsoft is aiming to remove fragmentation for both customers and software vendors, and to present a clearer integration path for AI agents, apps, and cloud services.

Comparison with AWS (And Others)

Microsoft’s move will likely be viewed in the context of Amazon’s Bedrock platform, which offers a catalogue of AI foundation models that can be accessed and deployed via Amazon Web Services. Bedrock is pitched as a simple, scalable way for enterprises to access large language models and build generative AI applications.

While Amazon focuses on model-level choices, Microsoft is emphasising agent-level integration and user experience inside Microsoft 365 and other products. This could give Microsoft an advantage among organisations already embedded in its cloud and productivity tools. However, buyers will still compare vendor flexibility, model variety, and pricing across platforms.

Benefits And Trade-Offs For Customers

For IT and procurement teams, the new Marketplace appears to offer a consolidated, governed route to access thousands of tools without the overhead of managing multiple platforms or bypassing security protocols. End users can gain access to approved apps and agents directly within their day-to-day workflows, thereby speeding up adoption and deployment.

Also, organisations already committed to Microsoft’s ecosystem may find they can deploy new AI tools faster, with fewer integration challenges. Microsoft’s claim of “one-minute deployment” and compatibility with enterprise security policies will appeal to large firms seeking rapid returns from AI investments.

However, some trade-offs remain. For example, the convenience of staying within the Microsoft ecosystem could lead to increased dependency on Microsoft services and commercial agreements, potentially limiting multicloud flexibility over time.

Risks, Challenges, And Criticisms

It’s worth noting here that the launch also raises some concerns around market dominance and vendor lock-in. For example, back in October 2023, the UK’s Competition and Markets Authority concluded a detailed market investigation into cloud infrastructure services, highlighting structural barriers that hinder customer switching and favour the largest providers. While Microsoft has disputed aspects of that ruling, the creation of a unified Marketplace could increase reliance on its platform, reinforcing the very dynamics under review.

Security is another area of possible scrutiny. For example, as organisations adopt AI agents capable of autonomous action, there are growing concerns about how those agents interact with data, tools, and users. Microsoft has acknowledged these risks in its own technical documentation, warning of potential agent failure modes and security misconfigurations linked to the Model Context Protocol (MCP), which underpins many of the agent integrations.

Also, cybersecurity researchers have highlighted risks such as prompt injection, over-permissioned access, and insecure connectors. While Microsoft’s promise of secure provisioning through the Marketplace is intended to mitigate these risks, the responsibility for implementation, governance, and oversight remains with each customer.

Operational complexity may be yet another challenge for Microsoft. While the Marketplace promotes one-click deployment, lifecycle management of AI and cloud apps, such as patching, compatibility checks, and vendor due diligence, remains a resource-intensive task. Organisations will, therefore, need to align their internal processes with Marketplace activity, particularly where data residency, industry-specific compliance, or software licensing is concerned.

Only In The U.S. For Now

Microsoft has also confirmed that the Marketplace is initially available only in the United States, with global rollout to follow. International customers will, therefore, need to monitor catalogue availability, regional billing options, and data handling assurances closely, particularly for regulated sectors or cross-border deployments.

What Does This Mean For Your Business?

UK businesses already using Microsoft 365, Azure, or Dynamics are likely to find immediate benefits in the new Marketplace (when it eventually rolls out here). For example, it simplifies procurement, shortens deployment times, and allows pre-approved AI tools to be delivered directly into users’ daily workflows without disrupting governance or procurement protocols. This could accelerate experimentation with Copilot extensions and industry-specific solutions, especially for organisations that need to show quick returns on AI adoption without introducing additional risk.

For Microsoft’s partners and independent software vendors, the move creates new opportunities and increased competition. With over six million monthly visitors and growing demand for AI solutions, the Marketplace now acts as both a distribution channel and a co-sell platform. Distributors embedding the Microsoft catalogue into their own storefronts could expand access further, although those in the partner ecosystem will need to adapt to Microsoft’s standards, pricing models, and resale mechanics.

For decision-makers, the challenge will be striking the right balance between speed and scrutiny. The promise of one-click AI agents is compelling, but responsibility for integration, oversight, and risk management stays with the customer. Organisations will still need to enforce least-privilege principles, vet vendors, monitor agent activity, and align Marketplace use with broader digital and security strategies. Those operating in regulated sectors may also need to carry out additional reviews to meet legal, contractual, or ethical obligations around data use and automation.

As previously mentioned, the global rollout will be another area to watch. UK organisations outside the United States will be looking closely at how quickly catalogue parity is achieved, whether billing and compliance frameworks are fully localised, and how Marketplace features such as resale enabled offers evolve once out of preview. For now though, the launch appears to mark a major consolidation of Microsoft’s cloud sales platform, one that could reshape how software is bought, sold, and used across the Microsoft ecosystem.

In this article, we look at why and how networkless attacks (which target cloud apps and identities) have created new opportunities for attackers and new risks for businesses, plus what your business can do to mitigate these risks.

The Move To SaaS and Cloud

In the rapidly evolving digital landscape, one of the key drivers enabling attackers to compromise an organistaion without needing to touch the endpoint or conventional networked systems and services is the increased reliance on cloud-based services and software-as-a-service (SaaS) applications (to drive efficiency and innovation). This shift, while beneficial, has also created new cybersecurity challenges for businesses, primarily due to the decentralisation of ‘digital identities’ and the interconnected nature of cloud services.

The SaaS Revolution and Its Impact on Security

The proliferation of SaaS applications is a direct result of the digital transformation that has reshaped the business world. For example, companies can now be using hundreds (if not thousands) of cloud applications to perform daily operations, from customer relationship management to financial operations. This shift is driven by the convenience and scalability of SaaS solutions, however it comes with inherent security risks.

The new risk that businesses are facing is that each application potentially serves as an entry point for malicious actors, and the interconnectivity between these apps can allow a breach in one service to cascade through to others.

Why Digital Identities Are The New Security Battleground

As the traditional network perimeter dissolves, digital identities become the new security frontier. Put simply, a digital identity can be a user account created for services that someone in the business has signed up for using a username/email and password. More broadly, it can also mean other personal data used to identify and authenticate users online.

These digital identities, which provide access to a myriad of cloud applications, are now central targets for attackers. Securing them has become increasingly complex due to the sheer number of them that businesses may be using and their dispersion across various cloud platforms, each with its own security environment. This decentralisation not only makes consistent security policies harder to enforce but also increases the complexity of monitoring these identities for potential breaches.

How Attackers Are Exploiting Vulnerabilities in Cloud Identities

Attackers have adapted to this new environment by developing sophisticated techniques to exploit vulnerabilities in cloud identities without ever touching the physical endpoints or traditional networked systems.

Examples of techniques include AiTM (Adversary in The Middle) phishing, SAMLjacking, and Oktajacking, all of which exploit weaknesses in the authentication processes and session management of cloud services.

AiTM phishing involves intercepting and manipulating real-time data during a session to steal credentials or manipulate transactions. SAMLjacking and Oktajacking focus on manipulating Single Sign-On (SSO) processes to gain unauthorised access.

Security stats now increasingly reveal that attackers are deliberately targeting cloud services as a way into organisations. For example, CrowdStrike figures show that 3 out of 4 attacks last year were malware-free (malware used to be one of the main threats) and that the targeting of cloud services has increased 110 per cent. This helps to illustrate why cloud identities are the new digital perimeter and that Cloud apps and identities (because of the shift to cloud services) now give attackers the same result as old-style attacks without them having to try and breach a network perimeter via the endpoint.

The Security Gap in Identity Management

Despite advances in cybersecurity, it’s clear to see why many businesses are now vulnerable to identity-based attacks. Traditional security measures like endpoint detection and response (EDR) systems and firewalls, for example, are less effective in a cloud-centric world where applications are accessed primarily through web browsers. This gap is exacerbated by the reactive nature of many security strategies, which focus on mitigating threats after they have been detected rather than preventing them proactively.

What Does This Mean for Your Business?

For UK businesses, their move to the cloud and the usage of a wide range and complicated combination of SaaS apps, digital identities, and the interconnection and decentralisation of these have meant that they are now vulnerable to networkless attack techniques, perhaps without realising it until now. The shift to cloud computing has not only expanded the attack surface but also highlighted the inadequacies of traditional security models in protecting digital identities. This means that UK businesses must now take a much closer look at the security of these identities as part of their overall cybersecurity strategy.

To mitigate the risks associated with networkless attacks, businesses should perhaps consider adopting a zero-trust security model, which assumes that threats could be internal or external and verifies each identity and device continuously, regardless of their location. Additionally, enhancing visibility across all cloud services and implementing advanced security measures like multi-factor authentication (MFA), behavioral analytics, and more sophisticated identity and access management (IAM) solutions could help.

In short, as these networkless attacks continue to evolve, UK businesses must be proactive with security, stay vigilant and adapt their security strategies. By understanding the vulnerabilities associated with digital identities and cloud services, and implementing security measures accordingly, businesses can safeguard their assets in the cloud era.