Julian Dyer, Vuzion CTO writes …
There has been much in the IT news recently about the changing requirements surrounding the Microsoft Cloud Agreement (MCA) – the document that all end user organisations must confirm to having seen and agreed to before being able to use Microsoft services.
Ensuring the customer has provided this consent has always been the responsibility of the partner, as part of the reseller’s terms and conditions with Microsoft – the change is that moving forward, the partner must provide a legal record of this having been done.
Introduced as a Microsoft GDPR compliance measure, the new requirement is due to become applicable from 25 May 2018.
But, don’t worry – there’s no need to panic!
The important thing is to be aware of what Microsoft are asking for – and to bear in mind, that it’s a new process, rather than a new request. Microsoft will be providing the system for confirming customer consent, and although there’s currently a lack of clarity around how this will behave, we’re expecting further details about the system to be announced over the coming months.
For resellers that don’t comply, there may come a point when orders are blocked for that reseller’s customers, and which may potentially apply from October 2018.
Resellers will at first be expected to provide consent confirmation for net new customers. This will then be extended to existing customers, and – depending on a reseller’s individual terms and the reseller being able to prove due diligence – it may be possible to bulk-attest for these existing customers.
One other point to remember is that financial services sector organisations need not only to agree to the MCA, but also to the Microsoft Cloud Agreement Financial Services Amendment, and which contains terms and conditions to support customers in the financial services industry and subject to oversight by financial services regulators, to meet privacy, security and regulatory requirements.
In the absence of full information about the new system for recording customer consent, it’s difficult to assess the requirement that will be needed on behalf of the reseller, but we’ll be posting updates as soon as we receive details.