Day 0 · Tenancy enablement · 02
STEP 2 — Day 0 Action Items (Tenancy Received, Nothing Built)
Inputs: the Day-0 section of the customer-answered Discovery Questionnaire (Strategy, Overview and Infra sheets: regions, subscription model, budget owners, alert recipients, DR intent). Day 0 is read-mostly: validate what Oracle delivered, switch on advisory/posture services, and wire the financial guardrails. No landing-zone resources are created.
2.1 Tenancy Profile & Subscription Validation
Sign in as the initial tenancy administrator; open the user profile and validate account details; enable MFA immediately.Tenancy details page: record Tenancy name, OCID, Home region, CSI number, and Tenancy (root) admin into the engagement runbook. The CSI number is required for every Oracle SR — capture it now.Billing & Cost Management → Subscriptions: open the Universal Credits subscription; validate the billing schedule, credit amount, and start/end dates against the order document. Discrepancies → raise with Oracle account team before building anything.Verify the Fusion SaaS order separately (pods per pillar and environment counts, e.g., Prod + Test + Dev pods for ERP/HCM/SCM/CX/EPM) — SaaS pods are provisioned by Oracle and will appear as service instances, not tenancy resources.2.2 Regions — Home, Subscribed, and Secondary
Console region selector → Manage Regions: confirm the Home region matches the questionnaire (data residency).If the questionnaire declares DR/replication/backup-copy requirements: subscribe the secondary region now — subscription is immediate but capacity and service availability should be validated before Day 1 designs assume them. Record the region pair in the DR ADR.Verify Fusion pod region alignment: integrations (OIC ↔ Fusion) should be co-located or latency-validated; note the pod data centers for the network design.2.3 Limits, Quotas and Usage Validation
Governance & Administration → Limits, Quotas and Usage: export the current service limits for the services in scope (Compute shapes for agent/SFTP VMs, ATP OCPU/ECPU, OIC message packs, Object Storage, LB bandwidth, VCN counts, FastConnect).Compare against the questionnaire-derived demand forecast; raise limit-increase SRs now for any shortfall (lead time is days — do not discover this during the landing-zone build).Plan compartment quotas (implemented in Step 3): zero expensive shapes (GPU/HPC) in Dev and Sandbox from day one.2.4 Announcements Subscription (email list)
Console bell icon → Announcements → Create announcement subscription: name it {org}-tenancy-announcements; select the Governance compartment (or root until it exists).Subscription type: All announcements (default) or Selected announcements with filter groups (note: only one of any particular filter type per filter group).Deliver to a Notifications topic whose subscriptions include the platform team DL, the security DL, and optionally Slack/PagerDuty endpoints — update the distribution list from the questionnaire's contact section, and re-validate it whenever team membership changes.2.5 Cloud Advisor Enablement
Governance & Administration → Cloud Advisor → Settings: check operational status (Active/Disabled).If disabled, select Enable. Note: a brand-new tenancy with zero resources may refuse activation — in that case revisit immediately after the first Step 3 resources exist; on tenancies with resources it is typically active by default.Assign review ownership: cost recommendations → cost-audit group; performance/fault-tolerance → platform team; security → security team. Monthly review cadence starts now.2.6 Cloud Guard Enablement
Identity & Security → Cloud Guard. If the resource page opens normally it is already enabled; if you land on onboarding, proceed.Select Enable Cloud Guard; review the required IAM policy panel (fresh tenancies show all as Not added) and use Create policy to auto-create them (includes manage cloudevents-rules and use network-security-groups). Any that remain Not added must be created manually per your IAM/Identity Domains configuration.Choose the Reporting Region deliberately — it is the legal/compliance boundary and cannot be changed later without disabling Cloud Guard (losing history and customizations). Usually the Home region.Monitor the whole tenancy (recommended) with detect-only posture initially; graduate detector recipes and responders per environment as the estate matures (per the customer's graduated model in the Governance Standard).2.7 Cost Analysis, Budgets and Alert Notifications
Billing & Cost Management → Cost Analysis: baseline current spend (should be near zero pre-build; SaaS subscription billing is visible per the order).Create a Notifications topic {org}-cost-alerts with email subscriptions for finance owner + platform DL (from the questionnaire's FinOps answers); confirm every subscription (recipients must click the confirmation).Create budgets: one tenancy-level budget now; per-compartment budgets follow in Step 3 once the tree exists. Alert rules at 70% / 90% actual and 100% forecast, targeting the topic.Schedule the monthly cost review (cost-audit group) and define the untagged-spend rule: untagged resources are a governance finding.2.8 Identity Domain Baseline Check
Identity & Security → Domains: open the Default domain and verify license type, region, and that only the expected initial administrators exist. Do not build the workforce domain yet (Step 3) — but remove/disable any unexpected users now.
2.9 Exit Criteria — Step 2
| # | Checkpoint |
|---|
| 1 | Tenancy profile, OCID, CSI, home region recorded; MFA on all admins |
| 2 | Subscription (Universal Credits schedule + Fusion pod order) validated against contract |
| 3 | Secondary region subscribed if DR/replication declared; region pair recorded |
| 4 | Service limits exported; shortfall SRs raised; quota plan drafted |
| 5 | Announcements subscription live to maintained email list |
| 6 | Cloud Advisor active with review ownership assigned |
| 7 | Cloud Guard enabled; reporting region decided; detect-only tenancy target |
| 8 | Cost topic + tenancy budget with 70/90/100 alerts confirmed by recipients |
| Field | Value |
|---|
| Document ID | <CUSTOMER>-RUN-D0-002 |
| Version | v1.0 (Generic Template) |
| Execution model | OPTION A — FULLY MANUAL (human engineers, OCI Console; no IaC/automation in the build path) |
| Customer | <CUSTOMER> — replace on engagement start |
| Tenancy | <TENANCY-NAME> / OCID: <TENANCY-OCID> |
| Prepared by | Cloud Platform Engineering |
| Review cycle | Per engagement; template annually |
1.1 Preconditions
Doc 1 (Governance Standard) is approved by the customer governance body.Tenancy is provisioned by Oracle and the administrator welcome e-mail has been actioned; the executing engineer can sign in to the OCI Console with a temporary tenancy-admin identity (to be retired in Doc 3, Phase A1).Universal Credits or pay-as-you-go subscription is active (validated in §2).[ISOLATED] model: run this entire runbook once per tenancy (SaaS tenancy and platform tenancy).The Discovery Questionnaire Day 0 rows below are answered by the customer — not assumed, not filled in by the engineer.| Questionnaire item | Feeds | Example answer |
|---|
| DS.02 / DS.03 — existing vs new tenancy; tenancy name | §2 tenancy validation | New · <TENANCY-NAME> |
| DC.03 — planned Oracle region(s) | §3 region subscription | Ashburn (home), Phoenix (secondary) |
| DR.01–DR.* (BCP & DR sheet) — RPO/RTO, DR scope, replication needs | §3.2 secondary-region decision | RPO ≤ 24h, RTO ≤ 8h; cross-region backup only |
| 0D.01 / 0D.02 — budget envelope; Day 0 cap; credits model | §7 budgets | $50/month Day 0 cap; Universal Credits |
| 0D.03 — strategic approvers (names + e-mails) | §4 announcement list, §7 budget alert recipients | CTO, CFO, CISO e-mails |
| SEC.* — security monitoring expectations; compliance frame (0C.02) | §6 Cloud Guard reporting region + scope | NIST CSF; monitor all compartments |
| O&M sheet — operations contacts, notification channels | §4 announcements; §7 alert channels | ops DL, Slack webhook |
| Capacity rows (Infra & Network sheet: workload counts, shapes) | §5 limits validation | 2× OIC, 3× ATP, 4 VMs |
WARNING:If any input row above is blank, stop and return it to the customer. Executing Day 0 on assumed answers creates rework that is expensive to unwind manually (e.g., a wrong Cloud Guard reporting region cannot be changed without disabling Cloud Guard and losing all findings history).
1.3 Build log
Open the engagement build log (template in Doc 6 §2) now. Every numbered procedure below ends with a build-log entry: date/time, executor, reviewer (four-eyes for anything that changes state), action, and evidence screenshot reference.
2. Tenancy Profile and Subscription Validation
2.1 Validate tenancy identity
Console path: Console (top-right) Profile icon > Tenancy: <TENANCY-NAME>
Sign in to the OCI Console with the temporary tenancy-admin identity.Open the Profile menu (top right) and select Tenancy: <TENANCY-NAME>.On the Tenancy Details page, record into the build log: Tenancy name, Tenancy OCID, Home region, Status, CSI number (needed for every Oracle SR).Confirm the tenancy name and home region match the contract and questionnaire DS.02/DC.03. The home region cannot be changed — if it is wrong, stop and raise with Oracle before doing anything else.VERIFY:Tenancy OCID recorded; home region matches the signed order document; CSI number stored in the engagement credentials vault.
2.2 Validate subscription and billing schedule
Console path: Menu > Billing & Cost Management > Subscriptions > Universal Credits
Open the Subscriptions page and select the Universal Credits (or Pay As You Go) subscription.On the detail page, review the billing schedule: start/end dates, committed amount, consumed amount.Record subscription ID, model (Annual Universal Credits / PAYG / BYOL components), and end date in the build log.[SAAS] Confirm the Fusion SaaS subscriptions appear (ERP/HCM/SCM/CX/EPM per licensed pillars). Cross-check the pillar list against the Oracle subscription document — this is the authoritative answer to "which pillars are licensed", not the sales deck.DECISION POINT:[CO-TENANTED] SaaS and IaaS/PaaS subscriptions in one tenancy: proceed. [ISOLATED] If SaaS subscriptions are missing here by design, note the SaaS tenancy name and repeat §2 there.
3. Region Management
3.1 Verify home region and subscribed regions
Console path: Console (top bar) Region selector > Manage Regions
Click the region name in the console top bar, then Manage Regions.Review the region list: the home region shows a Home badge; subscribed regions show Subscribed.Record subscribed regions in the build log.3.2 Secondary region enablement (replication / DR / backup)
DECISION POINT:Subscribe a secondary region ONLY if the questionnaire DR rows require cross-region backup, replication, or DR — or the customer confirms in writing. Consult the DR sheet (RPO/RTO) and Doc 1 §4 (DR compartment).
On Manage Regions, locate <SECONDARY-REGION> (choose the documented pairing for the home region — e.g., Ashburn↔Phoenix — unless data-residency answers 0C.01 dictate otherwise).Click Subscribe next to the region and confirm.Wait for the subscription to complete (typically minutes; the region then appears in the region selector).Record the secondary region and its purpose (backup copy target / object replication target / future DR site) in the build log and the decision log.IRREVERSIBLE:Region subscription cannot be undone — a subscribed region cannot be unsubscribed. It does not itself cost money (cost follows resources placed there), but it widens the governance surface: Cloud Guard scope, quotas, and cost monitoring must include it from now on.
NOTE:SaaS-only customers usually skip secondary-region subscription: Fusion DR is Oracle’s responsibility under the SaaS agreement. Subscribe a secondary region only when customer-side platform components (OIC/ATP/buckets) need cross-region protection.
4. Announcements and Notification List
4.1 Review current announcements
Console path: Console (top bar) Bell icon > Announcements
Click the bell icon to open the Announcements page; review any active items (maintenance, advisories) and note anything affecting the home/secondary regions.4.2 Create the announcement subscription (e-mail distribution list)
Console path: Announcements > Create announcement subscription
Click Create announcement subscription.Name: PLATFORM-ANNOUNCE-SUB-01. Compartment: root for now (re-home to Governance after Doc 3 creates it — record as a follow-up).Subscription type: All announcements (default), or Selected announcements with a filter group if the customer wants only specific services/regions — one filter per type; an announcement must match all filters in the group.Notifications topic: Create new topic — Name: TOP-PLATFORM-ANNOUNCE-01, in the same compartment.Subscription protocol: Email. Enter the customer operations distribution list <OPS-DL@CUSTOMER> (from the O&M sheet) — never an individual mailbox.Add the strategic approver addresses (0D.03) as additional subscriptions on the topic if the customer wants leadership visibility.Click Create.Each e-mail recipient receives a confirmation message — confirm every subscription (unconfirmed endpoints receive nothing). Chase confirmations the same day.VERIFY:Send nothing yet — instead check the topic shows all subscriptions in Active state (not Pending). Announcements service will now publish into the topic.
4.3 Maintaining the list
The announcement e-mail list is updated whenever operations contacts change (joiner/leaver in the customer ops team) — standing action in the O&M handover (Doc 6).Add the secondary region to filter groups if filters were used and §3.2 subscribed one.5. Limits and Quota Validation
Console path: Menu > Governance & Administration > Tenancy Management > Limits, Quotas and Usage
Open Limits, Quotas and Usage. Set Scope to the home region.Using the capacity rows from the questionnaire (planned OIC instances, ATP ECPUs/storage, VM shapes and counts, Object Storage, LBs), check each service family’s limit against the plan. Filter by service: Integration, Database, Compute, Object Storage, Load Balancer, Network.Record in the build log every limit where planned usage exceeds 70% of the current limit.For each shortfall, click the service limit row > Request a service limit increase (or open an SR with the CSI from §2.1): specify region, service, limit name, requested value, justification from the capacity plan. Limit increases can take days — raise them on Day 0, not when the build blocks.Repeat the check for <SECONDARY-REGION> if subscribed (limits are per region).Quotas (compartment-level caps) are NOT set today — they are created against the compartment tree in Doc 3 Phase A5. Record intended quota policies (e.g., zero GPU/HPC in DEV/SBX) in the build log as forward actions.VERIFY:A limits worksheet exists in the build log listing: service · limit name · current · planned · headroom · SR number (where raised). No planned service is above 70% of limit without an SR in flight.
6. Cloud Advisor and Cloud Guard Enablement
6.1 Cloud Advisor
Console path: Menu > Governance & Administration > Cloud Advisor > Settings
Open Cloud Advisor Settings. The status shows Active or Disabled.If Disabled, click Activate, then Enable in the dialog. Note: a brand-new tenancy with zero resources may refuse activation — in that case record it and activate at the end of Doc 3 Day 1 (resources will exist by then).Leave all recommendation categories enabled (cost, performance, security, fault tolerance).Record activation status in the build log.NOTE:Cloud Advisor is advisory and free; it becomes genuinely useful after workloads exist. The Day 0 obligation is simply that it is on and someone owns reviewing it (assign to Infrastructure Operations in the O&M handover).
6.2 Cloud Guard
Console path: Menu > Identity & Security > Cloud Guard
Open Cloud Guard. If the overview dashboard opens, it is already enabled — skip to step 8. If the onboarding page shows, proceed.Click Enable Cloud Guard (top right).Review the required IAM policies panel: each required permission shows Added or Not added. On a fresh tenancy expect all Not added.Click Create policy to auto-create the required policies (includes manage cloudevents-rules for audit event subscriptions and use network-security-groups for NSG activity detection). If any policy remains Not added, create it manually per your IAM configuration and re-check.Choose the Reporting Region. Use the home region unless the compliance answers (0C.01/0C.02) dictate a specific legal boundary.Select compartments to monitor: choose All (monitor the entire tenancy). Do not choose None.Click Enable. Then click Go to Cloud Guard to open the dashboard.Open Recipes: confirm the Oracle-managed detector recipes (Configuration, Activity, Threat) are attached at the tenancy target. Cloning to customer recipes happens in Doc 3 Phase A4 — Day 0 runs Oracle-managed defaults, detect-only.Open Alerts / Configuration and verify the target shows the root compartment with the default recipes.Record: reporting region, monitored scope, recipe versions in the build log.IRREVERSIBLE:The reporting region cannot be changed without disabling Cloud Guard, which erases all findings, history, and customizations. Confirm the region with the customer in writing before clicking Enable.
WARNING:Expect findings noise on day one (e.g., the temporary admin without MFA). Do not remediate ad hoc — findings are triaged in Doc 5 against the CIS baseline. Day 0 only ensures detection is on and history is accruing.
7. Cost Analysis and Budgets
7.1 Cost analysis baseline
Console path: Menu > Billing & Cost Management > Cost Management > Cost Analysis
Open Cost Analysis. Set the date range to the current month.Group by Service: on Day 0 of a fresh tenancy this should show at or near zero (SaaS subscription charges appear on the subscription, not consumption). Screenshot the baseline for the build log.[CO-TENANTED] Note which line items are SaaS subscription vs OCI consumption — the customer’s finance team will ask; budgets below track consumption only.Create a saved report: name D0-BASELINE-<DATE>, grouped by service, so month-one variance has an anchor.Enable Cost and Usage Reports if the customer wants CSV-level detail: Menu > Billing & Cost Management > Cost and Usage Reports (stored in an Oracle-owned bucket, readable with the policy statement shown on that page — record the policy for Doc 3).7.2 Budget with alert rules
Console path: Menu > Billing & Cost Management > Budgets > Create Budget
Click Create Budget.Scope: root compartment (per-compartment budgets follow in Doc 3 Phase A5 once the tree exists).Name: BUD-TENANCY-ROOT-01. Description: "Day 0 tenancy guard-rail budget".Monthly budget amount: the Day 0 cap from questionnaire 0D.02 (commonly ≤ $50/month for bootstrap; use the customer’s number, never a default).Alert rule 1: Threshold 70%, based on Forecast spend. Recipients: <OPS-DL@CUSTOMER> plus the budget approver (0D.03).Alert rule 2: Threshold 90%, based on Actual spend, same recipients.Alert rule 3: Threshold 100%, based on Actual spend, recipients plus the engagement lead.Click Create. Open the budget and confirm all three alert rules are listed.VERIFY:Budget exists with 70% forecast / 90% actual / 100% actual alert rules and correct recipients. Optionally validate delivery by temporarily setting a $1 threshold budget, observing the alert e-mail, then deleting the test budget — record the test in the build log.
NOTE:Budgets alert — they do not stop spend. The hard stops are the quota policies created in Doc 3 Phase A5 (e.g., zeroing GPU/HPC shapes in DEV/SBX). Say this to the customer explicitly; it is the most common Day 0 misunderstanding.
8. Identity Baseline Review (read-only today)
Console path: Menu > Identity & Security > Identity > Domains > Default
Open Identity > Domains in the root compartment and click Default.Record: domain type/license, user count (expect only the initial admin), sign-on policy state, MFA state.Verify the initial tenancy administrator has MFA enrolled — if not, enroll it now (Profile > My profile > Security). This is the one identity change permitted on Day 0.Make no other identity changes today. Identity domains, federation, break-glass accounts, and the retirement of this temporary admin are Doc 3 Phase A1 work, executed under change control.9. Day 0 Exit Checklist
| # | Exit criterion | Evidence |
|---|
| 1 | Tenancy identity validated (name, OCID, home region, CSI) and matches contract. | Build log §2.1 + screenshot |
| 2 | Subscription model and billing schedule recorded; licensed Fusion pillars confirmed from subscription doc. | Build log §2.2 |
| 3 | Region posture decided and recorded; secondary region subscribed only on documented DR requirement. | Build log §3 + decision log |
| 4 | Announcement subscription active; ops DL and approvers confirmed their e-mail subscriptions. | Topic subscription list screenshot |
| 5 | Limits worksheet complete; SRs raised for all shortfalls. | Limits worksheet + SR numbers |
| 6 | Cloud Advisor active (or deferred with reason logged). | Settings screenshot |
| 7 | Cloud Guard enabled: reporting region confirmed in writing, all compartments monitored, Oracle-managed recipes attached. | Cloud Guard config screenshot |
| 8 | Cost Analysis baseline saved; budget with 70/90/100 alerts live; recipients verified. | Budget detail screenshot |
| 9 | Default domain reviewed; temp admin has MFA; no other identity changes made. | Build log §8 |
| 10 | Build log complete with executor/reviewer per action; Day 0 gate reviewed with the customer. | Signed gate record |
Day 0 gate passed → proceed to Doc 3 (Day 1 Landing Zone, Phase A1). [ISOLATED]: both tenancies must pass their own Day 0 gate before Doc 3 starts in the platform tenancy.
Revision History
| Version | Date | Description |
|---|
| 1.0 | <DATE> | Generic template, console click-path edition. |
