Unified Billing Overview

This topic describes how you can unify billing across multiple tenancies by sharing your subscription. You should consider sharing your subscription if you want to have multiple tenancies to isolate your cloud workloads, but you want to have a single Universal Credits commitment. For example, you have a subscription with a $150,000 commitment, but you want to have three tenancies, because the credits are going to be used by three distinct groups that require strictly isolated environments.

Two types of tenancies are involved when sharing a subscription in the Console:
  • The parent tenancy (the one that is associated with the primary funded subscription).
  • Child tenancies (those that are consuming from a subscription that is not their own).

Notable benefits of sharing a subscription includes:

  • Sharing a single commitment helps to avoid cost overages and allows consolidating your billing.
  • Enabling multi-tenancy cost management. You can analyze, report, and monitor across all linked tenancies. The parent tenancy has the ability to analyze and report across each of your tenancies through Cost Analysis and Cost and usage reports, and you can receive alerts through Budgets.
  • Isolation of data. Customers with strict data isolation requirements can use a multi-tenancy strategy to continue restricting resources across their tenancies.

The remainder of this topic provides an overview of how to share your subscription between tenancies, and provides best practices on how to isolate workloads, in order to help you determine if you should use a single-tenancy or multi-tenancy strategy.

Planning Considerations

Before you get additional tenancies you should evaluate your needs to make sure that a multi-tenancy approach is best for your workloads. The main reason to have multiple tenancies is for strong isolation. By default, each parent and child tenancy comes with:

  • A distinct set of IAM users (which can be federated to another identity system).
  • A distinct set of IAM policies (permissions).
  • Its own service limits.
  • Isolated Virtual Cloud Networks (VCNs).
  • Separate security and governance settings.

The main point to be aware of is that multiple tenancies make it easier to isolate workloads, but that comes at the cost of needing to manage multiple tenancies. Additional tenancies, however, do create additional management overhead, so you need to ensure that the isolation is worth it. If you don't require a strong level of isolation, you should consider using compartments to separate workloads.

Required IAM Policy

To use Oracle Cloud Infrastructure, you must be granted security access in a policy  by an administrator. This access is required whether you're using the Console or the REST API with an SDK, CLI, or other tool. If you get a message that you don’t have permission or are unauthorized, verify with your administrator what type of access you have and which compartment  to work in.

If you're new to policies, see Getting Started with Policies and Common Policies.

To use subscription sharing, the following policy statements are required:

Allow group linkUsers to use organizations-family in tenancy
Allow group linkAdmins to manage organizations-family in tenancy

To accept an invitation but not create one use the following:

allow group linkAccepters to manage organizations-recipient-invitations in tenancy

To view the current linked tenancies but not the invitations:

allow group linkViewers to read organizations-links in tenancy

Subscription Sharing Overview

Depending on whether or not you already have multiple tenancies, there are two approaches:

If you don't already have an additional tenancy
  1. Sign up for a new PAYG (pay as you go) subscription to get a new tenancy. You do not incur any charges against the PAYG subscription, as long as you link it with your existing subscription before creating any billable resource. There are two ways to get a new PAYG subscription:
    1. Self-service: Sign up for a new trial using http://signup.oracle.com, and upgrade the trial to a paid account.
    2. Through sales: Work with your Oracle sales team to book a new PAYG order.
  2. Take note of the tenancy OCID in the new tenancy. You can find it on the Tenancy Details page in the Console. This page can be accessed by opening the Profile menu and then selecting Tenancy: <your_tenancy_name>. See the OCID field on the Tenancy Information tab.
  3. From the tenancy that owns the primary subscription, invite the new tenancy to share the subscription (described in To Share a Subscription).
If you already have multiple tenancies

There are two paths you can take:

  • If you have one primary tenancy that has a Universal Credits Flex (commitment) subscription and your subsequent tenancies have a PAYG subscription, you can follow the steps in If you don't already have an additional tenancy to get a new tenancy.
  • If your tenancies have multiple Universal Credits Flex (commitment), you will need to work with your Oracle sales team to rebalance your commitment balances.
    Note

    Rebalancing subscriptions is a manual process that needs to be coordinated, and rebalancing will not be available under all circumstances. Your sales team will work with you to rebalance your subscriptions and set up the parent-child billing relationship.

To Share a Subscription

Important

Ensure that you understand the terms of your contract before sharing your subscription with another tenancy. Your contract specifies how your subscription can be used, and which end users are allowed to use it.
Note

Before sharing a subscription, in the child tenancy, export historical cost data from Cost Analysis if you want to save your history.
  1. Sign in to the sender tenancy that will send the invitation, as a user that has permissions to manage subscription sharing.
  2. Open the navigation menu and click Governance and Administration. Under Cost Management, click Subscriptions. The Subscription Sharing page is displayed.
  3. Click Invite Tenancy. The Invite Tenancy panel is displayed.
  4. Enter the invitation details. You will need to specify the following:
    • The invitation name in Invitation Name. For the invitation name, it can be helpful to use notation that signifies the direction and number of sending invitation attempts. For example, entering a1 to b1 v1 can signify that tenancy a1 is sending an invitation to b1 and v1 as the first attempt. Such a convention allows the invitations to be more readable to the Console user, without having to access the Invitation Detail page to view sender and recipient details.
    • The child tenancy OCID in Recipient Tenancy OCID.
    • Optionally, an email address in Recipient Email, to notify that a sharing invitation has been sent.
      Note

      The recipient needs to have the proper permissions to manage subscription sharing in the child tenancy, in order to accept the invitation. For more information, see Required IAM Policy.
    • Optionally, enter tagging information.
  5. Click Send Invitation. The invitation is sent to the tenancy you are inviting to share the subscription with.
    Note

    Parent tenancies and tenancies that are not already in a sharing relationship can send invitations. Child tenancies cannot send invitations.
  6. On the recipient (child) tenancy: Open the navigation menu and click Governance and Administration. Under Cost Management, click Subscriptions. The Subscription Sharing page is displayed.
  7. The invitation from the other tenancy is displayed in the list, with the following information:
    • Invitation Name: Click this linked name to go to the Invitation Detail page.
    • Status: Displays the invitation status. For example, it is Active when the invitation is received but not yet accepted. From the parent tenancy, this field shows Pending for an invitation that has been sent but not yet accepted.
      The possible status states for a sender and recipient invitation are the following:
      Sender Invitation Recipient Invitation
      • PENDING
      • CANCELED
      • ACCEPTED
      • EXPIRED
      • FAILED
      • PENDING
      • CANCELED
      • ACCEPTED
      • IGNORED
      • EXPIRED
      • FAILED
    • Type: The invitation type, whether Sent or Received.
    • Created: The UTC creation date and time of the invitation.
  8. Click the Actions icon (three dots) and select Accept Sharing Invitation. An confirmation acceptance message is displayed, which indicates that you are about to accept a subscription sharing invitation from tenancy <OCID>.

    After clicking Accept, the invitation is processed, and the invitation's Status field changes to Updating. The tenancy then becomes a child tenancy.

    After the sharing invitation is accepted, it will take one to two hours for metering to start flowing to the subscription in the parent tenancy. From that time onwards, however, all usage in the child tenancy will be metered against the parent tenancy's subscription. In addition, after linking tenancies, we recommend you wait for a few hours before launching resources, that is, if you want to be sure all spending will accrue against the subscription of the parent tenancy.

    If there is a remaining subscription balance, contact your sales representative to move it to a primary subscription in the sending tenancy.

    Note

    Once the tenancy becomes a child tenancy, it cannot invite another tenancy to become a child tenancy. The Invite Tenancy button on the Subscription Sharing page becomes disabled to reflect this state.
  9. Open the child tenancy's Linked Tenancies page, where you can view the linking between the child and parent tenancy. The following information is displayed:
    • Tenancy OCID: The tenancy OCID.
    • Status: Displays the invitation status.
    • Established: The UTC date and time that the subscription sharing began.
    • Terminated: The UTC date and time that the subscription sharing began. This field is empty if the sharing is still active.

    Meanwhile on the parent tenancy's Linked Tenancies page, you can view the (child) tenancies that are being metered against your subscription.

To Revoke a Subscription Sharing Invitation

  1. Sign in to the primary tenancy as a user that has permissions to manage subscription sharing.
  2. Open the navigation menu and click Governance and Administration. Under Cost Management, click Subscriptions. The Subscription Sharing page is displayed.
  3. For the invitation you want to revoke, click the Actions icon (three dots) and select Revoke Invitation. A Revoke Invitation confirmation is displayed. Click Revoke to cancel the sharing invitation.
  4. On the Subscription Sharing page, the invitation's Status changes to Canceled.

Viewing Invitation Details

Invitation details can be viewed from both the parent and child tenancy. To view invitation details:

  1. Open the navigation menu and click Governance and Administration. Under Cost Management, click Subscriptions. The Subscription Sharing page is displayed.
  2. Click the linked invitation name from the Invitation Name field, or click the Actions icon (three dots) and select View Invitation Details. The Invitation Detail page is displayed.
  3. This page displays the invitation status, along with the following details on the Invitation Information tab:
    • Sent from Tenancy OCID
    • Type
    • Last Status Change
    • Sent to Tenancy OCID
    • Sent Date

    You can also click Add Tags to add tagging information, and view it on the Tags tab. See Resource Tags for more information.

Cost Reporting

Once a subscription is shared, the behavior of cost reporting tools changes. All spending against the subscription (in the parent and all child tenancies) is included in cost reporting in the parent tenancy, and child tenancies are limited to seeing spending in their own tenancy. Cost and usage reports are generated only in the parent tenancy, and include all usage for the parent and all of its children. Budgets are only supported in the parent tenancy. The following table describes the impact of subscription sharing on cost reporting.

Parent Tenancy Child Tenancies
Cost Analysis Reports on all usage and cost in the parent, and all children with the ability to group and filter by tenancy. Reports on all usage and cost in the child tenancy.
Note

If a child tenancy wants to use Cost Analysis from the Console, you must subscribe to the parent’s home region.
Cost and usage reports (CSVs) Includes all usage and costs in the parent and all children. Not available.
Budgets Budgets can be created against compartments or tags in the primary tenancy but not against child tenancies. Not supported.

Support

Depending on how you created your tenancy, you will either have separate CSI (Customer Support Identifier) numbers, and support accounts for each tenancy, or they will be combined. If you want to make sure that you get multiple CSI numbers, ensure that you work with your account team to create tenancies in a way that will create new CSIs.