diff --git a/atst/domain/csp/cloud.py b/atst/domain/csp/cloud/__init__.py
similarity index 99%
rename from atst/domain/csp/cloud.py
rename to atst/domain/csp/cloud/__init__.py
index c7134431..1597134f 100644
--- a/atst/domain/csp/cloud.py
+++ b/atst/domain/csp/cloud/__init__.py
@@ -1,4 +1,5 @@
 import re
+from secrets import token_urlsafe
 from typing import Dict, List, Optional
 from uuid import uuid4
 
@@ -177,7 +178,7 @@ class BaseCSPPayload(AliasModel):
 
 class TenantCSPPayload(BaseCSPPayload):
     user_id: str
-    password: str
+    password: Optional[str]
     domain_name: str
     first_name: str
     last_name: str
@@ -1070,7 +1071,7 @@ class AzureCloudProvider(CloudProviderInterface):
         sp_token = self._get_sp_token(payload.creds)
         if sp_token is None:
             raise AuthenticationException("Could not resolve token for tenant creation")
-
+        payload.password = token_urlsafe(16)
         create_tenant_body = payload.dict(by_alias=True)
 
         create_tenant_headers = {
diff --git a/atst/domain/csp/policy.py b/atst/domain/csp/cloud/policy.py
similarity index 100%
rename from atst/domain/csp/policy.py
rename to atst/domain/csp/cloud/policy.py
diff --git a/script/include/test_functions.inc.sh b/script/include/test_functions.inc.sh
index d6bf0b4d..bfd4d343 100644
--- a/script/include/test_functions.inc.sh
+++ b/script/include/test_functions.inc.sh
@@ -8,7 +8,7 @@ run_python_lint() {
 }
 
 run_python_typecheck() {
-  run_command "mypy --ignore-missing-imports --follow-imports=skip atst/domain/csp/cloud.py"
+  run_command "mypy --ignore-missing-imports --follow-imports=skip atst/domain/csp/cloud/__init__.py"
   return $?
 }
 
diff --git a/tests/domain/cloud/test_policy.py b/tests/domain/cloud/test_policy.py
index c0189262..18f0a7ab 100644
--- a/tests/domain/cloud/test_policy.py
+++ b/tests/domain/cloud/test_policy.py
@@ -1,4 +1,4 @@
-from atst.domain.csp.policy import AzurePolicyManager, AzurePolicy
+from atst.domain.csp.cloud.policy import AzurePolicyManager, AzurePolicy
 
 
 def test_portfolio_definitions():
diff --git a/tests/domain/test_portfolio_state_machine.py b/tests/domain/test_portfolio_state_machine.py
index eeebf6e9..97056ae7 100644
--- a/tests/domain/test_portfolio_state_machine.py
+++ b/tests/domain/test_portfolio_state_machine.py
@@ -1,5 +1,6 @@
 import pytest
 import re
+from unittest import mock
 
 from tests.factories import (
     PortfolioStateMachineFactory,
@@ -81,7 +82,10 @@ def test_state_machine_initialization(portfolio):
         assert ["reset", "fail", create_trigger] == started_triggers
 
 
-def test_fsm_transition_start(portfolio: Portfolio):
+@mock.patch("atst.domain.csp.cloud.MockCloudProvider")
+def test_fsm_transition_start(mock_cloud_provider, portfolio: Portfolio):
+    mock_cloud_provider._authorize.return_value = None
+    mock_cloud_provider._maybe_raise.return_value = None
     sm: PortfolioStateMachine = PortfolioStateMachineFactory.create(portfolio=portfolio)
     assert sm.portfolio
     assert sm.state == FSMStates.UNSTARTED
@@ -103,7 +107,7 @@ def test_fsm_transition_start(portfolio: Portfolio):
     ]
 
     # Should source all creds for portfolio? might be easier to manage than per-step specific ones
-    creds = {"username": "mock-cloud", "password": "shh"}
+    creds = {"username": "mock-cloud", "password": "shh"}  # pragma: allowlist secret
     if portfolio.csp_data is not None:
         csp_data = portfolio.csp_data
     else:
@@ -118,7 +122,7 @@ def test_fsm_transition_start(portfolio: Portfolio):
 
     portfolio_data = {
         "user_id": user_id,
-        "password": "jklfsdNCVD83nklds2#202",
+        "password": "jklfsdNCVD83nklds2#202",  # pragma: allowlist secret
         "domain_name": domain_name,
         "first_name": ppoc.first_name,
         "last_name": ppoc.last_name,
@@ -143,7 +147,6 @@ def test_fsm_transition_start(portfolio: Portfolio):
     config = {"billing_account_name": "billing_account_name"}
 
     for expected_state in expected_states:
-        print(expected_state)
         collected_data = dict(
             list(csp_data.items()) + list(portfolio_data.items()) + list(config.items())
         )