What the store reviewer checks
These checks come from the store's published rules. Open each source before you submit. The scan above checks your website, not your app or extension.
Privacy and terms links on the consent screen
For multi-tenant apps, the consent screen shows an alert if one or both of the two links are missing.
A verified publisher
Publisher verification uses a verified Microsoft AI Cloud Partner Program account linked to the app registration.
A domain that matches
The partner account email domain must match the app's publisher domain or be a DNS-verified custom domain.
What to account for
Two public URLs in the registration
Add a terms of service URL and a privacy statement URL to the app registration. In the app manifest they are the termsOfService and privacy fields under informationalUrls.
A work or school account
Apps registered with a personal Microsoft account cannot be publisher verified.
A real publisher domain
The publisher domain must be set and cannot be an onmicrosoft.com domain. The person who verifies needs MFA and an admin role.
Common mistakes to check
Using a location Partner One ID
Microsoft says the account must be the partner global account, not a partner location ID.
Leaving the links empty
Microsoft warns that missing links may discourage users from consenting to your app.
Your review checklist
Our suggested review process. The linked requirements above explain the platform or legal basis.
List the Microsoft data your app reads
Write down each permission you request, the data it returns, where you store it and for how long.
Scan your public site and draft
Scan the site that will host the privacy page. Review the suggested vendors, answer the business questions, then add the Microsoft data flows by hand.
Open both links while signed out
Paste the privacy and terms URLs in a private window. Both pages must load for anyone.
Example
Fictional app: Harbor Calendar Sync
Assume an app that reads a user's calendar to show free time and keeps it for 30 days. The scan sees analytics on the marketing site; the owner confirms what the app stores.
A useful next action
Add the 30-day retention and a deletion contact to the draft, then put the published URL in the app registration.
Questions before publishing
Do single-tenant apps need these links?
Microsoft says the terms and privacy links are not applicable to single-tenant apps.
Does publisher verification cost money?
Microsoft says it does not charge developers for publisher verification.
Is the draft reviewed by a lawyer?
No. A lawyer has not reviewed our templates. The draft is a starting point that you check and adapt against Microsoft's current rules.
Source review and changes
First edition: platform requirements, implementation checks and fictional worked example. Sources reviewed on the date above; verify changes before relying on them.