Reseller or Direct? When to Buy Cloud Software From a Partner vs the Vendor

TL;DR

For most South African and international SMBs and mid-market businesses, buying cloud software through a reseller wins on price-equivalence, ZAR billing, advisory and support. Direct from the vendor only earns its keep when you’re an F500 with a dedicated Customer Success Manager, a procurement team that owns the renewal, and an in-house Microsoft or Google admin bench deep enough that you don’t need outside help. Below that threshold, partner channel is the right answer.

Where does buying direct actually make sense?

Three specific scenarios. They share a shape: you’ve already paid, in salaries, for the capability a partner would otherwise bring.

You have an in-house Microsoft or Google admin team. Not one administrator who also does helpdesk. A bench. People whose entire job is the platform: Conditional Access design on M365, Context-Aware Access on Google Workspace, OAuth grant audits, GAM scripting on tap, Defender for Cloud Apps tuning. If that team exists and is staffed properly, the advisory layer a reseller adds duplicates work you’ve already paid for.

Your volume gets you a dedicated CSM at the vendor. Microsoft assigns named Customer Success Managers above roughly 1,000 to 2,400 seats depending on SKU mix. Google Workspace allocates dedicated CSMs above the 1,000-seat mark for Enterprise customers. Bitdefender’s enterprise tier hands you a named TAM around the 2,500-endpoint line. Below those numbers you do not have a dedicated CSM. You have a sales rep who picks up the phone on renewal week and a public support queue the rest of the time. Above those numbers, the vendor’s white-glove team is genuinely valuable, and they only work with you direct.

You don’t want any intermediary in renewal conversations. Some procurement teams have a stated policy: no resellers in the negotiation. Usually because they’ve been burned by a reseller adding margin on a discount the vendor would have given anyway, or because procurement has its own commercial muscle. If you’re at that scale, direct is the answer.

Outside those three scenarios, the calculus inverts.

Where does buying via a reseller make sense?

The larger universe by a long way. For SMBs and mid-market (10 to 1,000 seats, give or take) the reseller channel is built for you and the vendor’s direct channel is built around you.

You want ZAR billing, not USD or EUR. Microsoft repriced South African retail twice in the last 18 months, and the published rand price floats off a stale exchange rate that adjusts on Microsoft’s clock, not yours. Google Workspace direct billing in ZAR works for some plans but not all, and Enterprise SKUs often quote in USD with a converted invoice that drifts. Bitdefender direct from Romania bills in EUR. A South African reseller pulls partner pricing, locks the rand rate at the point of invoice, and issues a local VAT invoice your AP system already knows how to ingest.

You want one invoice across your stack. A typical SME runs Microsoft 365, possibly Google Workspace alongside it, Bitdefender, Exclaimer, an MDM, a backup, an SMTP relay. Direct billing means seven vendor portals, seven invoices, seven renewal conversations. Through a reseller, one monthly invoice, in rand, line items per service. AP loves it.

You want advisory included. Vendors structurally cannot offer this. Microsoft sales is incentivised to sell E5. Google sales upsells Business Plus or Enterprise. Bitdefender’s direct team is incentivised to sell XDR. None of them get paid to tell you to step down a SKU because Vault usage is light, or to skip Defender for Cloud Apps because your fleet is small enough that Conditional Access plus a tuned Sensitivity Label policy will do. A reseller making the same margin on Business Standard and Business Premium has no reason to push you up the ladder. We’ve talked clients down the SKU ladder more often than up it.

You want SLA-backed support that beats vendor T1. Microsoft’s first-line support is a public queue, often outsourced, with median response on a P3 ticket measured in days. Google Workspace direct support is competent but the priority queue is reserved for direct-billed enterprise. Bitdefender’s direct portal queues you behind every consumer customer. A reseller running CSP-tier escalation picks up your ticket on a one-hour SLA during business hours, opens the case with the vendor on your behalf, and chases it. You don’t wait on hold. We do.

What does an OSH-as-reseller relationship look like?

Specific, because the abstraction is the easy part.

Consolidated invoicing. One ZAR invoice per month, line-itemed across every service we resell. Microsoft 365 seats and SKU mix, Google Workspace seats if you run dual-stack, Bitdefender endpoints by tier, Exclaimer, MDM seats, backup. VAT invoice, predictable monthly rand cost.

ZAR pricing. We pass through partner pricing from the vendor (Microsoft Cloud Solution Provider tier, Google Cloud partner programme, Bitdefender partner tier) and bill it in rand. Where pricing is volatile because the vendor moves it, we tell you in advance of the renewal and give you the option to pre-pay an annual term to lock it. Microsoft’s NCE annual commit is the obvious one.

Technical advisory included. Not “advisory if you buy a separate consulting block.” Included in the managed-service fee that sits alongside the licence cost. SKU right-sizing reviews twice a year, Conditional Access policy revisits quarterly, GAM scripting on demand, mailbox sizing reviews, security baseline scoring. The engineers who configure your tenant handle the billing. You don’t get bounced between sales and support. Read why your IT partner should be offering you X for what “advisory” should actually contain.

CSP-tier support escalation. When something breaks on Microsoft’s side, we open the case in the partner portal, not the public one. Different queue, different SLA, different engineering tier. Same on Google Workspace and Bitdefender: partner contacts answer when something is on fire.

Licence right-sizing reviews. Every renewal cycle, and on demand mid-term if headcount changed. Leavers reclaimed, joiners assigned, SKU mix adjusted to actual usage. A year of drift on a 100-seat tenant is usually 10 to 15% of the licence bill. We’ve seen 20%.

What changed in 2024 to 2026 that makes the partner channel matter more?

Three structural shifts. All push toward partner channel for SMB and mid-market.

Microsoft NCE shifts. The New Commerce Experience landed in 2022 and has been tightening since. Annual commits are the default; monthly commits carry a 20% premium on most SKUs. Mid-term cancellations are tightly restricted. Adding seats mid-term is fine; reducing them within an annual term is, in practice, not. Direct customers signing an annual commit are locked for twelve months. CSP partners get the partner-managed annual commitment, which sits inside a relationship where the partner reads your usage and warns you before you lock in fifteen extra licences for a year. We’ve stopped clients from signing the wrong annual commit more than once. Microsoft direct, by design, will not.

Google Workspace billing complexity. Google added Flexible, Annual and Commitment plans with different pricing per SKU per region. The pricing page shows USD by default and the rand conversion is sometimes wrong by a couple of percent. Enterprise SKUs are quote-only. Promotional discounting works through the partner channel and rarely shows up in direct online checkout. Even a sophisticated buyer can’t easily price-compare without a partner pulling actual numbers.

Vendor support quality drift. Anyone who has run a P2 case with Microsoft direct support in the last two years knows the score. 2018 first-line support was fine. 2026 first-line support is, in our experience, slower and less technically deep. Google Workspace direct support held up better but the priority queue tightened. Bitdefender’s direct support is competent but volume-stretched. The partner channel sits behind a different door, staffed differently.

The combined effect: partner channel, once a “nice to have” for an SMB buying M365, is now the practical default. You’re getting access to a tier of service direct simply doesn’t price for SMB volume.

Are reseller prices higher or lower than direct?

Honest answer: mostly comparable. Sometimes lower, occasionally higher, almost never enough difference to change the decision.

The mechanic. Vendors give partners a wholesale discount off list. Partners pass any portion through. A partner passing 100% through takes zero margin on the licence and funds their operation through the managed-service fee. A partner passing nothing through charges list and pockets the discount. Most reputable partners sit in the middle.

Where reseller is cheaper. Promotional pricing that only flows through partners. Microsoft routinely offers partner-only campaign discounts on specific SKUs. Google Workspace runs partner promos several times a year. Bitdefender’s three-year deals are partner-channel-only.

Where direct is cheaper at scale. Above the dedicated-CSM threshold, vendors negotiate enterprise agreements with discounts a partner cannot match. Microsoft Enterprise Agreement (EA) pricing at 2,400-plus seats. Google Cloud committed-use discounts at the largest tier. If you qualify, direct wins on raw licence cost. Part of why direct makes sense for the F500.

Where prices are functionally identical. Most of the SMB and mid-market range. The partner margin is real but offset, often more than offset, by the advisory work, ZAR billing, consolidated invoicing and the support queue. We’ve done the spreadsheet: line by line, the partner-channel quote and the direct quote came within 2% on licence cost, and the direct quote had no advisory included.

If a partner is materially more expensive than direct on the same SKUs, ask why. Either they’re charging premium margin and there had better be premium service, or something is mispriced.

How does this change for security tools like Bitdefender, Exclaimer and others?

These vendors push partner channel harder than the productivity-suite vendors do, and direct often costs more, not less.

Bitdefender. Direct purchases on the Bitdefender website are at MSRP. Partner pricing is materially below MSRP, depending on tier and term length. Partner is the default path for business GravityZone licensing. The consumer storefront exists for home users, not businesses. Buying GravityZone direct is a thing you can technically do, and a thing you almost never should. See the Bitdefender page for the module breakdown.

Exclaimer. Same shape. Exclaimer’s direct sales target enterprise deals. SMB pricing and the practical onboarding work flow through partners. Setting up Exclaimer well requires DNS work that intersects with your DMARC posture. Buying direct without a partner who knows what they’re doing is a fast route to a half-broken implementation that quietly damages email deliverability. The Exclaimer page covers the integration detail.

Smaller vendors generally. Hexnode and most security and operations tools in the SMB stack price partner channel deliberately below direct. The vendor wants the partner doing deployment, training and support because that’s how the product gets used properly and renews.

Pattern: the more configuration the product needs to work properly, the harder the vendor pushes partner channel.

How do you actually pick the right partner?

The partner-channel argument falls apart if you pick the wrong partner. Real questions to ask.

Response SLAs in writing. Not “we’ll get back to you quickly.” Hours, in writing, by priority. P1 (tenant-down): one hour during business hours, on-call out of hours? P2 (single-user impact): four hours? P3 (configuration request): same business day? If the SLA isn’t documented, it doesn’t exist.

Escalation paths. What happens when first-line can’t fix it? Who is the senior engineer? When does the case get opened with vendor partner support, and how do they keep you in the loop?

Technical depth. Ask the partner to walk you through one specific scenario. “Our Conditional Access policy locked out the CFO at 11pm on a Tuesday. What do you do?” If the answer is hand-wavy, the depth isn’t there. If it involves break-glass account procedure, sign-in log analysis and which CA policy report-only counter to check first, you’ve found the depth.

Advisory cadence. How often does the partner proactively look at your tenant? Monthly Secure Score review? Quarterly CA-policy revisit? Annual licence right-sizing? “When you call us” is reactive, not advisory.

Reference customers. Two or three businesses they’ve supported for over three years, willing to take a five-minute call. Not testimonials on the website. Live phone numbers.

Tenant ownership and admin access. Who owns the tenant? You. Who has Global Admin? You, plus the partner with named accounts under your tenant. If the partner wants to own your tenant or refuses to give you a Global Admin you control, walk away.

Renewal price transparency. Will the partner notify you in writing thirty days before any renewal price change? Will they show you the line-item breakdown of vendor cost vs partner margin? Opaque renewals are how partner relationships go bad.

What’s the worst-case partner relationship to avoid?

Easier to describe by failure mode than by success criteria. If your current relationship has any of these, it’s worth a conversation.

Locked-in tenant ownership. The partner registered the M365 tenant under their own domain, with their own admin accounts, and listed your business as a customer rather than the tenant owner. To leave, you’d have to migrate the entire tenant. We’ve inherited two of these. The migration costs were significant and avoidable.

No admin access. You have a single user account on your own M365 or Google Workspace tenant. The partner has Global Admin and won’t share. If they go quiet on a Friday, you cannot reset a password on Monday. Unconscionable and disturbingly common.

Opaque billing. The invoice says “Cloud Services, R47,000”. No breakdown of seats, SKUs, services. You have no way to verify you’re being charged for what you’re using. We see this on at least one in five inherited engagements.

No advisory. The partner sells you licences and answers tickets. They don’t review your Conditional Access posture, audit your licence usage, tell you when a SKU is wasted, or proactively flag a renewal price change. The margin is going somewhere; it’s not going to your benefit.

No notice on renewal price changes. You sign an annual commit. Twelve months later the renewal is 18% higher and you find out from the invoice. A partner worth the margin reads vendor price changes, models them against your tenant, and writes to you sixty days ahead with impact and options. Vendors raise prices; that’s normal. Hiding it until invoice day is not.

No documentation handover. Ask for a tenant runbook, architecture diagram, a list of every CA policy, every Defender exclusion, every Intune compliance policy, every transport rule. If they can’t or won’t produce it, you have a vendor of black-box services, not a partner. The day the relationship ends, you lose institutional knowledge of your own environment.

The good news: the partner market is competitive enough that you can leave any of these relationships. First step is usually a read-only audit by a different partner.

Get a 30-minute reseller-fit conversation

Thirty minutes on a call. Bring three things: your current SKU mix across Microsoft 365, Google Workspace, Bitdefender and any other cloud software in your stack; your current partner if you have one and what they cover; your renewal dates for the next twelve months. We’ll tell you where margin is leaking, where advisory is missing, and whether partner channel (through OSH or anyone else) is the right answer for your shape.

If direct is the right answer for you, we’ll say so. We’ve handed clients back to direct billing and stayed on as advisory.

Email support@osh.co.za or use the form on /services/. Calendar link returned the same business day.

Service pages: Microsoft 365, Google Workspace, Bitdefender, Exclaimer.