Public cloud accounts are easier to split. Not easy.

Estate inventory and target account architecture.

Cloud separation starts with a complete estate inventory. AWS accounts inside AWS Organizations with the relevant Organizational Units and Service Control Policies. Azure subscriptions inside the seller Microsoft tenant with the relevant management groups and Azure policies. GCP projects inside the seller organization with the relevant folder structure and IAM bindings. The workloads running inside each account covering compute, storage, databases, analytics, machine learning, and managed services.

Target architecture depends on whether Newco workloads sit in dedicated accounts or are mixed with seller workloads inside shared accounts. Dedicated accounts move with Newco using vendor supported account move processes. Mixed accounts require workload migration into new Newco accounts. The decision is finalized in the first 30 days of the runway and reflected in the migration plan.

AWS supports account invitations into a new Newco AWS Organizations master account. The accounts retain their resources, ARNs, and identifiers. Azure supports subscription transfer into a new Newco Microsoft Entra tenant. The transfer preserves resource IDs in many cases and requires resource provider re registration. GCP supports project transfer into a new Newco organization through a vendor managed process. Each vendor supports the move. None of them does it instantly.

A clean inventory and architecture decision unlocks every downstream cloud decision. The commercial structure. The IAM rebuild. The network redesign. The integration redesign. The pattern aligns with the TSA exit IT separation sequence and the broader carve out IT plan.

Commercial and the cloud cost transfer.

Cloud commercial structures vary by vendor. AWS sells through Enterprise Discount Programs, Solution Provider Programs, and direct savings plans and reserved instances tied to a payer account. Azure sells through Enterprise Agreements and Microsoft Customer Agreements with commitments tied to the seller tenant. GCP sells through Cloud Customer Agreements with committed use discounts tied to the seller billing account. The seller commitments do not transfer cleanly to Newco.

The negotiation is a one shot opportunity. Newco signs a direct cloud agreement with each in scope vendor. The preparation covers committed spend by service, the BATNA from alternative cloud platforms, and the term length. Where Newco can credibly migrate workloads from one cloud to another, the negotiation has leverage. Where Newco is committed to the current cloud and the current architecture, leverage comes from term length, ramped commitments, and pre committed marketplace spend.

Reserved instances, savings plans, and committed use discounts present a specific challenge. The seller paid for these commitments. They do not transfer to Newco. Newco operates on on demand pricing in the first weeks after move and signs new commitments after consumption stabilizes. The TSA cost recovery is negotiated so that the seller does not bill Newco a mark-up on commitments that the seller is recovering through other tenants.

Marketplace subscriptions are the workstream that always lands later than planned. Every SaaS vendor that bills through the seller cloud marketplace has to re entitle Newco through the Newco cloud marketplace or shift to a direct vendor contract. The audit discipline runs through the TSA vendor cost pass-through audit framework.

Account move and identity rebuild.

Account move is the central technical event. AWS account move uses the AWS Organizations invitation and acceptance flow. The account leaves the seller organization and joins the Newco organization. Resources stay in place. ARNs stay in place. The new payer account assumes billing responsibility from the move date. Azure subscription transfer uses the Microsoft transfer tool with directory change. GCP project transfer uses a vendor managed process initiated through support.

IAM rebuild is the most consequential workstream. The seller IAM roles, identity federation, and service control policies do not move cleanly. Newco rebuilds the IAM model in the new organization. The new identity provider integration replaces the seller identity provider integration. Roles, policies, and trust relationships are rebuilt for the new account structure. Cross account access boundaries are redefined for Newco operating teams.

Cross account dependencies are inventoried and resolved before the move. Where a Newco workload depends on a seller workload through cross account IAM, the dependency is either migrated, broken, or converted to a vendor neutral integration. The same applies for shared services like centralized logging, security tooling, and observability infrastructure. The boundary is documented per workload with explicit dependency owners.

Tenant isolation in Azure is more nuanced than account isolation in AWS or project isolation in GCP. The Azure subscription transfer can move workload resources but the Microsoft Entra ID for those resources stays linked to the source tenant unless explicitly switched. The directory change adds an extra step and creates risk for managed identities that have to be reconfigured after the move.

Network, security, and shared service migration.

Network architecture is rebuilt around the Newco account structure. The transit gateways, virtual networks, peering relationships, and on premises connectivity are redesigned for Newco. Direct Connect, ExpressRoute, and Cloud Interconnect circuits are migrated or replaced. DNS zones move to Newco managed services. Firewall and web application firewall policies are rebuilt for the Newco perimeter. The network boundary is a major piece of work and is often the longest pole in the public cloud separation.

Security tooling moves from seller managed instances to Newco managed instances. Security Information and Event Management, cloud security posture management, container security, and data security tools are rebuilt for the Newco account structure. The seller security operations team typically continues monitoring during a TSA period until Newco security operations are stood up. The boundary is documented with explicit alert routing and escalation paths.

Shared services that the seller hosted for Newco move with Newco or get replaced. Centralized logging in a seller log account moves to a Newco log account. Centralized monitoring in a seller monitoring account moves to a Newco monitoring account. Centralized backup, key management, and certificate authority services are rebuilt for Newco. The migration is sequenced so that workloads always have somewhere to write logs and metrics.

Data egress costs during the migration are a real economic line item. Moving terabytes between regions or out of a cloud incurs data transfer charges. The migration plan accounts for these charges and chooses routes that minimize them. The cost model is shared with the seller so that data transfer charges are not disputed after the fact.

Cutover, FinOps, and stabilization.

Cutover for an account move is shorter than for a workload migration. The AWS invitation flow can complete in minutes. The Azure subscription transfer typically completes within hours. The GCP project transfer can take several days from request to completion. The runbook covers pre move validation, the move execution, post move validation, IAM re bind, network re bind, and shared service re bind. The runbook is rehearsed against a non production account before the production move.

For workload migrations into new accounts, the cutover is longer. Each workload migrates through an infrastructure as code redeploy, a data migration, and a DNS cutover. The migration uses cloud native tools such as AWS Application Migration Service, Azure Migrate, or Google Migrate for Compute Engine alongside service specific tools for databases, storage, and analytics.

FinOps discipline is essential after the move. Newco loses the seller committed pricing in the first weeks and pays on demand pricing while consumption stabilizes. The cost reporting establishes a daily review of consumption against budget. Reserved instances, savings plans, and committed use discounts are purchased after consumption stabilizes. The first month of cloud spend after the move is typically 20 to 40 percent above the steady state target. The recovery is planned and measured.

Stabilization runs for 30 to 60 days. Production issues get triaged within defined service-level commitments. The TSA exit certification for infrastructure services follows successful stabilization. The discipline runs through the TSA exit milestones framework.

Cost discipline and where carve outs go wrong.

Public cloud separation programs run between $300K and $5M depending on workload count, network complexity, security tooling rebuild scope, and data egress volumes. The cost dispersion reflects whether the move is a clean account transfer or a workload migration into new accounts. The economic discipline is to scope tightly to in scope accounts and workloads, hold the implementation partner to fixed fee, and avoid scope expansion that does not serve the Newco operating model.

The most common cost overruns trace to network architecture rebuild scope, undocumented shared service dependencies, and unbudgeted data egress. The fix is the disciplined inventory before contract signing, the early network design review that prices the rebuild realistically, and the change control process that prices every scope addition in writing. Where these controls are in place, the program lands within the original budget plus or minus 10 percent.

The most common timeline overruns trace to delayed vendor commercial signature, late identification of marketplace dependencies, and slow seller cooperation on cross account dependency unwinding. The fix is the explicit dependency map maintained by the PMO with named owners on both sides and a weekly governance rhythm that escalates blocks within 48 hours. Cloud separation is fast when both sides cooperate. It is slow when either side drags.

A clean public cloud separation produces a Newco that runs its own cloud estate under its own commercial with direct support, clean IAM, and the optionality to evolve the architecture on Newco timeline. The discipline runs through the TSA exit acceleration program and is delivered under a Fixed Fee + Portfolio Retainer engagement model.

More on platform separation.