Why MSPs Should Own Their Cloud Infrastructure Instead of Reselling It

Most MSPs built their cloud revenue on a straightforward model: buy Microsoft licenses at a discount, resell at markup, earn the spread. That model is under real pressure in 2026. Microsoft raised the Direct Bill partner threshold from $300,000 to $1,000,000 in trailing twelve-month CSP revenue, pushing smaller partners to Indirect Reseller status and handing a 3-5% margin slice to distributors.

Azure consumption incentives shifted from resale margin to outcome-based rewards that favor partners who drive specialization and workload consumption, not transaction volume. The message is clear: Microsoft does not pay you to resell a license. They pay you to ensure clients use the platform. For MSPs whose P&L depends on the spread between wholesale and retail, the structure has changed. This article covers what the alternative model looks like and when it makes sense to build it.

How the Azure CSP Margin Structure Actually Works

The Azure CSP program gives partners a discount off Microsoft’s list pricing, which they can pass on to clients or retain as margin. For Microsoft 365 subscriptions, industry analysis places typical CSP indirect reseller margins at 10-15% net. For Azure consumption billing, margins are considerably thinner, in the 3-8% range, before accounting for the distributor cut that indirect resellers pay.

The implication is that a client spending $10,000 per month on Azure consumption might generate $300-800 in resale margin for an indirect reseller before any managed services revenue. The managed services layer on top of that, migrations, ongoing support, architecture consulting, is where the real revenue sits. Microsoft has always been explicit about this: the license margin is the entry point to a customer relationship, not a sustainable standalone business.

Microsoft’s FY26 program changes make this dynamic more explicit. The Direct Bill threshold increase to $1M TTM removes direct billing access for smaller and mid-sized MSPs, adding a distributor layer to the commercial model. Azure outcome-based incentives increased 70% year-over-year in FY26, but they reward partners for specialization and workload consumption, not for being a billing intermediary. Partners who don’t hold advanced specializations in areas like Data and AI or Digital and App Innovation see reduced incentive structures compared to prior years.

None of this means Azure reselling is a broken model. M365 subscriptions generate predictable recurring revenue, the ecosystem integrations are genuine, and Azure’s global footprint covers use cases that no MSP-owned infrastructure can replicate. But for the portion of the MSP business that is pure infrastructure, compute, storage, and networking for client workloads, there is a different model worth understanding.

What Owning the Infrastructure Changes

When an MSP builds on OpenMetal infrastructure instead of reselling Azure, the cost structure inverts. Rather than buying from a vendor at wholesale and reselling at a controlled markup, the MSP pays a fixed monthly cost for dedicated hardware and sets its own client pricing.

A three-node OpenMetal Cloud Core provides the foundation: physical servers running OpenStack and Ceph, with all compute, block storage, object storage, and networking included in the fixed monthly price. The MSP pays that monthly cost to OpenMetal. What they charge clients for the services running on that infrastructure is their decision.

The margin arithmetic is different. The MSP’s cost of goods is known, fixed, and doesn’t change when a client’s usage spikes. The pricing they charge clients can reflect the value of what they’re delivering: dedicated infrastructure, predictable performance, data residency, compliance-grade isolation. Those are real differentiators in the mid-market and regulated verticals where many MSPs compete, and they command different pricing than commodity cloud reselling.

The tradeoff is that the MSP takes on infrastructure responsibility that Azure bears in the CSP model. Hardware is managed by OpenMetal. OpenStack and Ceph operations, VM provisioning, network configuration, and client environment management sit with the MSP. This is a genuine operational requirement. It fits MSPs who already have infrastructure engineering capacity or who want to build it. It doesn’t fit MSPs who want to remain purely in the managed services layer without owning the platform layer underneath.

How OpenStack Multi-Tenancy Works for an MSP Practice

The architectural feature that makes a private cloud practice economically viable for MSPs is OpenStack’s multi-tenancy model. A single physical cluster serves multiple isolated client environments through OpenStack Projects.

Each OpenStack Project provides a client with a logically isolated environment: its own virtual machines, networks, storage volumes, security groups, and API credentials. Clients cannot see or access resources in other Projects. The MSP manages the underlying hardware and OpenStack platform while each client operates within their own provisioned environment. Adding a new client is an API call and a Project configuration, not a hardware procurement cycle.

The isolation is real and auditable. Network traffic between Projects traverses the MSP’s infrastructure over dedicated VLANs. A client’s data lives in their Project’s storage volumes and doesn’t commingle with another client’s data at the application layer. For clients with compliance requirements, HIPAA, PCI DSS, or NIST 800-53, this isolation supports the kind of documentation and audit trail that multi-tenant public cloud environments make harder to produce clearly.

For MSPs serving clients with the most sensitive data requirements, OpenMetal’s XL v4 and XL v5 servers support Intel TDX, providing hardware-level Trust Domain isolation where even the infrastructure operator cannot access the encrypted memory of a running workload. How that confidential computing capability factors into compliance conversations for MSP clients is covered in more detail separately.

OpenMetal deploys new private clouds in approximately 45 seconds using proprietary automation. Adding servers to an existing cluster takes approximately 20 minutes. For an MSP onboarding a new client or scaling an existing one, the infrastructure provisioning is not the bottleneck.

The Tooling Layer

Running a multi-tenant private cloud practice requires tooling for client provisioning, billing, and lifecycle management. The MSP doesn’t manage this through OpenStack’s native interfaces alone.

The OpenMetal and ModulesGarden partnership delivers a direct integration with WHMCS, the billing and client management platform used widely in the MSP and hosting space. The OpenStack Projects For WHMCS module automates client provisioning, suspension, and lifecycle management from within WHMCS. The VPS and Cloud For WHMCS module allows MSPs to sell individual virtual machines to clients, with provisioning and billing handled automatically. The Advanced Billing For WHMCS module adds usage-based invoicing for CPU, memory, storage, and bandwidth.

This means the commercial layer of running a private cloud practice, pricing, billing, renewals, and client self-service, is available off the shelf rather than requiring custom development. For MSPs who already run WHMCS, the integration point is familiar.

OpenStack’s API-first architecture means the provisioning automation isn’t limited to WHMCS. MSPs who have built or want to build custom client portals can provision and manage environments through the OpenStack API using the same calls that run major public clouds globally.

What You’re Offering That Azure Resellers Can’t

The business case for building a private cloud practice depends on having clients who value what private infrastructure provides. That client segment exists and is growing, but it’s not every client.

Data residency and sovereignty

Clients who need their data to remain in a specific jurisdiction without exception, EU financial services firms operating under DORA, healthcare organizations with HIPAA obligations, or public sector entities with data localization requirements, are better served by dedicated infrastructure at a known location than by shared public cloud with configurable data residency settings. OpenMetal operates Tier III data centers in Ashburn VA, Los Angeles CA, Amsterdam NL, and Singapore, with each client’s data physically resident in the chosen facility.

Dedicated hardware, no shared noisy neighbors

Cloud VM performance variability is a real operational problem for latency-sensitive workloads. An MSP who can offer a client guaranteed performance on dedicated hardware, with no other tenants on the same physical servers, is offering something qualitatively different from shared cloud infrastructure. For clients running real-time applications, high-frequency transaction processing, or performance-sensitive databases, that difference is measurable.

Predictable pricing

Public cloud’s variable billing model means clients receive surprise invoices when workloads grow, egress increases, or service configurations change. Fixed monthly pricing gives both the MSP and the client a number they can plan around. For clients who have experienced significant cloud cost volatility, this is a tangible selling point.

Compliance documentation

MSPs serving regulated clients spend time producing evidence of control environments for audits. Single-tenant infrastructure with dedicated VLANs, documented data locations, full audit logging, and direct access to hardware provenance provides a cleaner audit trail than shared cloud environments.

What You Still Use Azure For

Building a private cloud practice doesn’t mean replacing Azure in every client stack. Most clients who move workloads to dedicated private infrastructure still use Azure for some services and Microsoft’s ecosystem for productivity and collaboration.

Microsoft 365, Entra ID (formerly Azure Active Directory), Teams, SharePoint, and the broader Microsoft productivity layer remain the standard for most business clients. The private cloud conversation is specifically about where compute and storage for applications and data workloads live, not about productivity software. An MSP can run a client’s application workloads on OpenMetal while that same client continues running M365 through the CSP relationship. These are additive, not mutually exclusive.

The segment where this makes the most sense is mid-market and enterprise clients with compliance requirements, clients running workloads that benefit from dedicated infrastructure, and organizations where data sovereignty is a real business requirement rather than a theoretical preference. These clients exist in financial services, healthcare, legal, and increasingly in technology companies handling sensitive data.

How to Approach Building a Private Cloud Practice

The starting point is not a full migration of the MSP’s portfolio. It’s identifying the clients who are already asking the questions that private cloud answers: Where does our data live? Can we get dedicated infrastructure? Why is our cloud bill unpredictable? Can you document the isolation between our environment and other tenants?

Those clients represent the pilot cohort. Running a PoC for one or two clients on OpenMetal infrastructure before expanding the practice gives the MSP’s engineering team time to become proficient with OpenStack operations, build out the WHMCS or billing tooling, and validate the commercial model before committing to a broader rollout.

OpenMetal’s MSP use case page covers the program structure, including white-labeling capabilities and the commercial options for partners. The PoC program provides a structured 30-day evaluation window for MSPs building out the initial proof of concept before client commitments.

Frequently Asked Questions

What is the Azure CSP Direct Bill threshold change in FY26?

Microsoft raised the Direct Bill partner threshold from $300,000 to $1,000,000 in trailing twelve-month CSP revenue, effective in FY26. Partners below this threshold are transitioned to Indirect Reseller status, which adds a distributor layer between the partner and Microsoft and reduces the margin the partner retains on license resale.

How does OpenStack multi-tenancy work for an MSP serving multiple clients?

OpenStack Projects provide logically isolated environments for each client on shared physical infrastructure. Each Project has its own VMs, virtual networks, storage volumes, security groups, and API credentials. Clients cannot access other Projects’ resources. The MSP manages the underlying platform and provisions new client environments through the OpenStack API or management interfaces. A new client environment can be provisioned in under a minute.

What does a client get on dedicated private cloud that they don’t get on Azure?

Dedicated physical infrastructure with no shared noisy neighbors, explicit data residency at a known facility, a cleaner audit trail for compliance documentation, and predictable fixed monthly pricing. Azure offers managed services, a global footprint, and ecosystem integrations that private cloud doesn’t replicate, so the right choice depends on the client’s workload profile and requirements.

Can MSP clients still use Microsoft 365 if their compute workloads move to OpenMetal?

Yes. M365, Entra ID, and other Microsoft productivity and identity services are independent of where a client runs their application and data workloads. An MSP can run a client’s compute and storage on OpenMetal while that client continues using M365 through the CSP relationship.

Does OpenMetal support white-labeling for MSPs?

Yes. OpenMetal’s platform supports white-labeling, allowing MSPs to present the service under their own brand. The WHMCS integration via ModulesGarden allows MSPs to manage client provisioning, billing, and lifecycle management through a branded interface.

What OpenStack services are available for MSP client environments?

OpenMetal’s private clouds include Nova (compute), Cinder (block storage), Swift (object storage), Neutron (networking with VPCs, security groups, and virtual routers), and Keystone (identity and access management). Each client Project gets access to these services within their isolated environment.