Set up Cloud Identity as a Google Cloud admin
This document shows you how to set up Cloud Identity and become a Google Cloud administrator who can manage Google Cloud users and resources. Setting up Cloud Identity is one of the first steps that you'll take when creating a Google Cloud resource hierarchy.
Before you begin
If you're a Google Cloud administrator, follow these steps to sign up for either Cloud Identity Free or Cloud Identity Premium. For more information about the differences between these services, see Compare Cloud Identity features and editions.
Requirements
- Cloud Identity Free: You need your company's domain name and the administrator username and password to your domain registrar to get started.
- Cloud Identity Premium: You need your company's domain name to get started, or you need to purchase a domain during sign-up.
Sign up for Cloud Identity Free
If you're a Google Workspace customer
Sign in with an administrator account to the Google Admin console.
If you aren't using an administrator account, you can't access the Admin console.
Go to Billing > Buy or upgrade.
Make sure that you have the Billing management administrator privilege.
In Categories, click Cloud Identity.
In Cloud Identity Free, click Get Started.
Follow the guided instructions.
If you're not a Google Workspace customer
- Go to the following sign-up page: https://workspace.google.com/gcpidentity/signup?sku=identitybasic
- Follow the guided instructions.
For details about your next steps, see Create your Cloud Identity account and first administrator user.
Sign up for Cloud Identity Premium
If you're a Google Workspace customer
Sign in with an administrator account to the Google Admin console.
If you aren't using an administrator account, you can't access the Admin console.
Go to Billing > Buy or upgrade.
Make sure that you have the Billing management administrator privilege.
Click Cloud Identity.
Next to Cloud Identity Premium, click Start Free Trial.
Follow the guided instructions.
If you're not a Google Workspace customer
- Go to the following sign-up page: https://workspace.google.com/gcpidentity/signup?sku=identitypremium
- Follow the guided instructions.
Create your Cloud Identity account and first admin user
To create your Cloud Identity account and first admin user using the Setup Wizard:
- For About you, enter your first and last name in the Name field.
In Current email address you use for work, enter your email address.
This email address will be used as a recovery address. It must be different from the address you create that you'll use as your admin account for Cloud Identity.
In the About your business section, for Business or organization name, enter your company name.
In the Country/Region list, choose the appropriate country or region.
To set up your domain, click Next.
In the Your Cloud Identity Domain window, add the domain that you've already purchased for your company. You'll later need to verify that you own the domain.
In the Create your Cloud Identity account window, enter a username and password. This account is your Cloud Identity administrator account and must be different from the email address you entered in step 2. As a best practice, we recommend that you enter a username with the following format:
admin@example.com
For more details and instructions about verifying your domain, see Verify your domain for Cloud Identity.
Congratulations! You successfully enabled Cloud Identity and created your first user.
Finishing setup
After you create your Cloud Identity account and verify your domain, you're returned to the Google Cloud console. Before you continue, you'll need to accept the Cloud Identity Agreement on behalf of your organization. You're then directed to the Identity page.
You now have a fully functioning Cloud Identity account. But you'll also have the option to complete a few more setup steps in the console, described in this document.
Note: Later, you might want to return to the Google Admin console to add more users and create groups. For instructions, see Manage users.
About your Cloud Identity organization
Your Cloud Identity organization is created after you finish your signup and setup steps for your Cloud Identity service. This maps a Cloud Identity account from the Admin console to Google Cloud, and is used to group all of your projects for billing and management purposes. For example, using your Cloud Identity organization you can restrict project access only to Cloud Identity users.
As the first super admin to access the Google Cloud console, you'll be assigned the role of Org Owner, and you'll be able to manage the organization settings and assign policies at the highest level.
Migrate projects and billing accounts and set permissions
Important:
- Complete steps 1–2 from your non-administrator Google Cloud account. This account is typically a personal Gmail account.
- Complete steps 3–6 from your Cloud Identity administrator account.
To migrate content from a previous account, follow these steps:
Step 1: Grant access to billing accounts
Follow these steps to migrate projects and billing accounts from accounts outside of your Cloud Identity organization to your new Cloud Identity organization. We recommend that you open this page in a separate tab to use as reference while completing the steps.
- Sign in to the Google Cloud account that has the existing billing account you want to connect to.
- Grant your organization admin from Cloud Identity access to
this billing account.
- Go to the left nav and open Billing.
- Navigate to the billing account that you want to connect to.
- Add the Organization admin of your Cloud Identity as a Billing administrator.
Step 2: Grant access to projects
You can grant access to projects one at a time or using the bulk permissions UI. Step 1 walks through the one-at-a-time method, while step 2 walks through the bulk method.
- Grant your organization admin Owner access to projects.
Navigate to the IAM and Admin page for the projects you want to migrate, and add your organization admin's account as Owner. - Set Bulk permissions (optional).
Navigate to the IAM and Admin section and click Manage Resources or All projects from the left navigation. From the Manage Resources view, select all the projects you want to migrate and use the Identity and Access Management (IAM) panel to add your new account as Owner to these projects.
Step 3: Sign in to your Cloud Identity account, and accept the project invitations
Sign in to your Cloud Identity account and check your email.
For the projects you're migrating, you must accept the project invitation sent by email to your new account. You must click the link in each email for each project that you're migrating.
Step 4: Go to Google Cloud, sign in with your Cloud Identity account, and remove access
- Remove access to the billing account.
Navigate to the billing account you connected from your old account, and remove access for any user accounts that are not within your company's domain, including your @gmail.com account. - Remove access to projects.
- Navigate to the IAM and Admin page, and click Manage Resources.
- From the Manage Resources page, select No organization from the drop-down list next to the filter control.
- The projects from your old account are displayed with a yellow warning icon. Select these projects and use the IAM panel to remove access for any accounts that are not within your company's domain, including your @gmail.com account.
Step 5: Migrate projects
- Navigate to the IAM and Admin section, and click Manage Resources.
- From the Manage Resources page, click No organization from the drop-down list next to the filter control. The projects from your old account are displayed with a yellow warning icon.
- Select these projects from your old account, and click Migrate from the top bar, or click the icon for each project.
After the migration is finished, your projects will be moved to your company's organization. You must switch the No organization drop-down to your company's organization to view the projects.
Step 6: Set permissions
- Navigate to the IAM and Admin section, and select your organization from the top bar drop-down list. This will allow you to set IAM permissions that will affect all projects under your organization.
- From the IAM page, add your Admin users and grant them the appropriate roles.
For more details, see also Configuring permissions on Google Cloud.
Activate a Cloud Billing account
Free trial users: After you set up Cloud Identity, check your billable status to verify that you have remaining free trial credits. When the free trial offer ends, you can activate a full, paid Cloud Billing account to continue to use Google Cloud resources that require a Cloud Billing account. To learn more about the free trial, see Free cloud features and trial offer.