cloud-administration

# Cloud administration Corporate cloud is bought, not architected. Someone needed a tool, expensed it, and it entered the estate without a review, an owner, or an offboarding path. The characteristic failure is not a bad design — it is discovering the estate years later, one invoice at a time. This is the cloud the business runs on. For the cloud a product is built on — environments, infrastructure as code, scaling, region failure — see `technology:cloud-infrastructure`. The two follow different rules and the boundary is worth keeping sharp. ## Structure the tenant before you need to Subscription and account structure encodes what you can later separate: billing, access, policy, and blast radius. Retrofitting it means moving live workloads, so the cheap moment is the first one. A workable default is to separate by what you would want to bill, govern, or lose independently — production corporate services, non-production, and anything with a distinct compliance obligation. Resist a subscription per team; teams reorganize, and the structure outlives them. Tag at creation with owner, cost center, and environment, and enforce it with policy rather than documentation. Untagged resources become unattributable spend within a quarter, and nobody volunteers to claim them. ## The SaaS estate is the part nobody is managing Most companies underestimate their application count by a wide margin, because the ones they know about were bought by IT and the rest were bought by everyone ...