cloud-administration

Cloud administration

Corporate cloud is bought, not architected. Someone needed a tool, expensed it, and it entered the estate without a review, an owner, or an offboarding path. The characteristic failure is not a bad design — it is discovering the estate years later, one invoice at a time.

This is the cloud the business runs on. For the cloud a product is built on — environments, infrastructure as code, scaling, region failure — see technology:cloud-infrastructure. The two follow different rules and the boundary is worth keeping sharp.

Structure the tenant before you need to

Subscription and account structure encodes what you can later separate: billing, access, policy, and blast radius. Retrofitting it means moving live workloads, so the cheap moment is the first one.

A workable default is to separate by what you would want to bill, govern, or lose independently — production corporate services, non-production, and anything with a distinct compliance obligation. Resist a subscription per team; teams reorganize, and the structure outlives them.

Tag at creation with owner, cost center, and environment, and enforce it with policy rather than documentation. Untagged resources become unattributable spend within a quarter, and nobody volunteers to claim them.

The SaaS estate is the part nobody is managing

Most companies underestimate their application count by a wide margin, because the ones they know about were bought by IT and the rest were bought by everyone else. The discovery methods that actually work are financial, not technical: expense reports, corporate card statements, and the identity provider's sign-in logs. Network monitoring finds less than the accounting system does.

Every application needs a named business owner, a renewal date, and a data classification. Without the owner there is nobody to ask at renewal. Without the renewal date the negotiation happens after auto-renewal. Without the classification, nobody knows which breach notification obligations apply when the vendor is compromised.