# Multi-org management without the chaos

Orgs are the hard isolation boundary in Datadog: separate data, separate billing, separate keys. Use them for real boundaries (prod vs dev, company vs subsidiary, client separation), not for teams (that is what tags are for).

## The setup

1. **One org per boundary**, named for the boundary. Org sprawl is as bad as org sharing; need a real reason per org.
2. **Keys per org**: API keys are org-unique. The agent in org A can never submit to org B with org A key, which is the point. Manage the key inventory per org; know which key is where.
3. **Terraform per org**: separate provider blocks (api_key, app_key, api_url per org) or workspaces per org. Never one state file writing to two orgs; a mis-targeted apply is a cross-org incident.
4. **Child orgs for clients**: if you are an MSP or platform team, child orgs give each tenant isolation with centralized management.

## Governance

- **Central auth, local keys**: SSO/SAML at the org level for humans; service keys per org for automation.
- **Cost attribution**: per-org billing makes chargeback trivial. If finance asks "what does team X cost," the org answer is clean.
- **Site consistency**: pick the site per org deliberately (data residency). Moving orgs between sites later is painful.

## Verify

Each org agent status green in its own org, keys inventoried, Terraform state per org, and a test submission to org A is invisible in org B.