# Ensure tenancy has at least one active non-root compartment

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698517507703-ensure-tenancy-has-at-least-one-active-non-root-compartment
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the tenancy has at least one active compartment other than the root compartment, so that resources can be organized by team, application, or environment. Compartments are the main way to separate resources and control who can access them in OCI.

**Rationale**

Without child compartments, all resources end up in the root compartment, where policies apply to the whole tenancy. This makes it impossible to give a team access to only its own resources. Creating compartments is the foundation for least-privilege policies, separate environments, and cleaner cost and access reviews.

**Impact**

-   Enables separation of resources by team or environment
    
-   Allows narrow, compartment-level policies
    
-   Resources may need to be moved into the new compartments
    

**Default Value**

By default, a new tenancy has only the root compartment, plus in some cases a ManagedCompartmentForPaaS compartment created by Oracle.

**Pre-Requisites**

-   Tenancy administrator access
    
-   A compartment design, such as one per environment or team
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Compartments.
    
3.  Verify that at least one compartment other than the root is listed with the state Active (ignore ManagedCompartmentForPaaS).
    
4.  If none exist, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Compartments.
    
3.  Select Create compartment.
    
4.  Enter a name and description, select the root compartment as the parent, and select Create compartment.
    
5.  Move resources from the root compartment into the new compartment where appropriate.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Compartments.
    
3.  Move any resources out of the new compartment, then open it and select Delete.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Identity/compartments/managingcompartments.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/compartments/managingcompartments.htm)
    
-   [https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/IAM/create-non-root-compartment.html](https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/IAM/create-non-root-compartment.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.