Azure Marketplace SaaS Subscription Error – Missing x-ms-marketplace-token

The error indicates that the publisher’s Resolve API call is missing the mandatory x-ms-marketplace-token header, which must contain the purchase token that Azure Marketplace passes on the landing-page redirect.

From the documented flow:

1. After the customer selects Configure account / Configure your account, Azure Marketplace redirects the customer to the publisher’s landing page with a token query-string parameter, for example:
   • https://contoso.com/signup?token=<token>
2. The publisher must:
   • Read and URL-decode this token value from the landing page URL.
   • Call the Resolve API:
     • POST https://marketplaceapi.microsoft.com/api/saas/subscriptions/resolve?api-version=2018-08-31
     • Include the following headers:
       • authorization: Bearer <access_token> (publisher’s token)
       • x-ms-marketplace-token: <decoded token>
       • content-type: application/json
3. If x-ms-marketplace-token is missing, malformed, invalid, or expired, the Resolve API returns HTTP 400.

In this case, the 400 HeaderNotPresent with “Mandatory header missing” means the publisher’s backend is calling the Resolve API without the x-ms-marketplace-token header at all, even though the Marketplace redirect is expected to include the token parameter.

What this implies for the subscription state and token handling:

• The subscription can be in any supported state; the Resolve API is still callable. The 400 being returned is not due to subscription state, but due to a missing header.
• The Marketplace token is generated by Microsoft and passed as the token query parameter on the redirect; the publisher is responsible for:
  • Extracting it from the URL.
  • Decoding it (for example, ab%2Bcd%2Fef → ab+cd/ef).
  • Supplying it in the x-ms-marketplace-token header when calling Resolve.
• If the token were expired or malformed, the error would still be 400, but the description in the documentation explicitly calls out missing, malformed, invalid, or expired token as the 400 causes. The specific HeaderNotPresent message points to the missing header, not an issue in Azure Marketplace token generation.

Given the documented behavior, the most likely root cause is on the publisher side (NinjaOne onboarding endpoint) rather than tenant, billing, or regional configuration:

• The Marketplace redirect is expected to work for all supported tenants and regions.
• Tenant or billing issues typically affect the ability to purchase or subscribe, not the presence of the token parameter or the x-ms-marketplace-token header in the publisher’s Resolve call.

Recommended next steps based on the documented flow:

1. Confirm that the SaaS subscription shows as not yet configured:
   • In Azure Portal, locate the SaaS resource and check the status text:
     • If it shows Configure your account on the publisher’s website, the purchase is created but configuration is incomplete.
2. Engage the publisher (NinjaOne) with the exact error details:
   • Provide the 400 HeaderNotPresent error and note that their Resolve call to https://marketplaceapi.microsoft.com/api/saas/subscriptions/resolve?api-version=2018-08-31 is missing the x-ms-marketplace-token header.
   • Reference that they must:
     • Read the token query parameter from the landing-page URL.
     • URL-decode it.
     • Pass it as x-ms-marketplace-token in the Resolve API request.
3. If the publisher confirms their implementation is correct but the issue persists, open a Microsoft support case for Marketplace/SaaS subscription lifecycle so support can:
   • Validate that the Marketplace redirect is correctly including the token parameter.
   • Check for any backend issues with the subscription or token issuance.

Once the Resolve call succeeds (HTTP 200), the publisher receives the SaaS subscription ID and can then:

• Complete configuration on their side.
• Call the Activate Subscription API:
  • POST https://marketplaceapi.microsoft.com/api/saas/subscriptions/<subscriptionId>/activate?api-version=2018-08-31
  • With the required headers and a valid publisher authorization token.
• Only after a successful Activate call does billing start.

References:

• SaaS fulfillment Subscription APIs v2 in Microsoft Marketplace
• Managing the SaaS subscription life cycle
• Private offer troubleshooting