Governing shadow cloud accounts.

This is a multicloud strategy issue as much as a cost one, because shadow accounts fragment exactly the spend that gives you negotiation leverage. A bill split across a dozen unmanaged accounts cannot earn the volume tier that the same spend, consolidated, would.

Why shadow accounts cost more than they look

The visible cost of a shadow account is its monthly bill. The real cost is larger and comes from four places.

First, lost discounts. An account outside consolidated billing earns no shared volume discount and cannot draw on a Savings Plan, Reservation, Committed Use Discount, or Universal Credit commitment bought elsewhere. You pay on demand rates for capacity your enterprise agreement would otherwise cover.

Second, unwatched waste. No budget, no tagging, no anomaly alert means idle instances, orphaned storage, and forgotten environments accumulate with nobody watching. Shadow accounts are where the clearest waste tends to hide, precisely because no owner sees the bill.

Third, fragmented leverage. Negotiation leverage at a renewal comes from a credible, consolidated forecast. Spend scattered across accounts finance cannot enumerate weakens the very number you take to the table.

Fourth, security and compliance exposure. An account outside your guardrails is outside your logging, your access controls, and your audit scope. The cost conversation is often what finally surfaces a real risk problem.

Step one: discover every account

You cannot govern what you cannot list. Discovery reconciles two views and closes the gap between them.

• From finance. Pull expense reports, corporate card statements, and vendor invoices for any charge from AWS, Azure, GCP, or OCI. Personal card reimbursements are a common tell.
• From the providers. Enumerate every account, subscription, project, and tenancy linked to your corporate domains and payer relationships, then compare against the accounts already inside your organisation structures.

The difference between what finance is paying for and what the platform team manages is your shadow estate. Most enterprises are surprised by the size of it.

Step two: consolidate under one organisation

Once discovered, accounts come home into a managed structure: AWS Organizations with consolidated billing, Azure management groups under your tenant, GCP under your organisation resource hierarchy, and OCI under your tenancy and compartments. Consolidation does three things at once.

It puts every account under one bill, so spend earns shared volume and commitment discounts and shows up in your cost model. It applies your guardrails, so tagging, budgets, anomaly alerts, and access controls reach accounts that had none. And it gives you a single forecast, restoring the consolidated number that drives negotiation leverage at your next renewal. For how that leverage works, see the cross cloud cost optimization guide.

Consolidation rarely needs to disrupt the teams that created the accounts. The workloads keep running; what changes is who can see the spend and what discounts it earns. Done carefully, the first thing those teams notice is a lower bill.

Step three: close the door

Discovery and consolidation are one time recoveries. Governance is what stops the shadow estate growing back. The controls are straightforward: a sanctioned, fast path to request a new account so teams have no reason to go around you, organisation policies that block account creation outside the managed structure, and a monthly reconciliation of finance records against managed accounts so any new shadow account surfaces within weeks rather than years.

The goal is not to slow teams down. A heavy approval process is what created the shadow accounts in the first place. The goal is to make the sanctioned path the path of least resistance, so governance and speed point the same way. This is the same showback and ownership discipline that makes budgets stick, which we cover in multicloud showback that holds up.

What to report to leadership

Shadow account work produces a clean before and after that boards understand: the count of accounts brought under management, the spend now earning commitment coverage that was previously on demand, the idle resources removed, and the security exposure closed. These are the kind of multicloud measures worth standing in front of the board, which we expand on in multicloud cost KPIs for the board.

Find the spend you cannot see

We help enterprises discover, consolidate, and govern their full cloud estate across AWS, Azure, GCP, and OCI, recovering discounts and closing risk in the process. Our guarantee: we reduce your cloud spend or we reimburse our service fee.