9.2 Organizations Management, Governance Rules & Compartment Quotas

Why Multiple Tenancies

Compartments isolate resources inside one tenancy, and for many organizations that is enough. Some situations call for separate tenancies:

• Strict data isolation between business units, subsidiaries, or customers.
• Separate identity domains and administrators for an acquired company.
• Isolated sandboxes where experiments cannot affect production identity or policies.
• Regulatory requirements that demand a hard administrative boundary.

The challenge is that separate tenancies normally mean separate contracts, separate bills, and separate, inconsistent guardrails. Organizations Management solves this by linking tenancies into one organization.

Parent and Child Tenancies

A child tenancy joins in one of two ways:

1. Created by the parent. The parent creates a brand-new tenancy. It consumes from the organization's default subscription unless another subscription is selected. Its home region must be one of the parent's subscribed regions, and it inherits the parent's current default service limits, although each child then has its own limits that are not shared with other tenancies.
2. Invited. An existing standalone tenancy is invited to join the organization and change its default subscription.

The parent uses subscription mapping to assign subscriptions to any child tenancy.

Central Cost Management

Because the tenancies share a commitment, the parent can analyze and report spending across every linked tenancy using Cost Analysis, cost and usage reports, and Budgets alerts. This avoids the overages that happen when each tenancy has its own small commitment.

Governance Rules

A governance rule is an enforcement that the parent tenancy creates to govern a resource in child tenancies. When a rule is attached, a corresponding resource is created in the target tenancy and locked. Users in the child tenancy see a lock icon and cannot modify it. To change it, the parent must update the rule.

Oracle supports three types of governance rules:

Points that exam questions test:

• An allowed-regions rule prevents subscribing to other regions, but if the child already subscribes to a region not on the list, that subscription remains and resources can still be deployed there.
• If you change a resource in the parent that a rule was built from, such as a tag namespace, you must update the governance rule for the change to reach child tenancies.
• Rules can be attached to specific tenancies or to all current and future tenancies that have joined organization governance. Tenancies can be opted in to or out of organization governance.
• Rules can be attached while creating a child tenancy, so new tenancies start with guardrails already in place.

Compartment Quotas Inside a Tenancy

Governance rules work at the tenancy level. Inside each tenancy, administrators use compartment quotas to divide capacity between teams. Quotas are written as policy-like statements:

zero compute-core quotas in tenancy
set compute-core quota standard-e4-core-count to 40 in compartment Production
unset compute-core quota standard-e4-core-count in compartment Sandbox

• set defines a maximum.
• zero blocks the resource entirely.
• unset removes a quota inherited from a parent compartment's statement.

Quotas differ from service limits. Service limits are set by Oracle for the tenancy and can be raised with a limit increase request. Quotas are set by your administrators to stay below those limits and to stop one team from consuming everything.

Designing a Multitenancy Organization

A common enterprise pattern combines both layers:

1. A parent tenancy holds the subscription, billing, and governance rules.
2. Child tenancies isolate business units or regulated workloads.
3. Governance rules set allowed regions, tag defaults, and baseline quotas for every child.
4. Inside each child, compartments, IAM policies, Security Zones, and Cloud Guard provide the finer-grained controls covered in the rest of this chapter.

This design keeps the strong isolation of separate tenancies while preserving central visibility and control.

Two planning details are worth remembering. SaaS or multicloud subscription services can be activated in the parent or in a child tenancy, but resources against those subscriptions can only be provisioned in the tenancy where they were activated. And an invited child tenancy must be removed from the organization with its original subscription before it can be deleted, so plan tenancy lifecycles before inviting them.