[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Assign Identity and Access Management roles and permissions\n\n| **Note:** When assigning permissions related to a cross-organization-resource migration, you must designate the roles on the same principal email address in both the source and the destination organization resources.\n\nYou need the following permissions to migrate a project between\norganization resources.\n\nTo gain these permissions, ask your administrator to grant the suggested role at\nthe appropriate level of the\n[resource hierarchy](/iam/docs/tags-access-control#resource-hierarchy).\n\n### Project migration permissions\n\nTo migrate a project between organization resources, you need the following roles on the project, its parent\nresource, and the destination resource:\n\n- Project IAM Admin (`roles/resourcemanager.projectIamAdmin`) on the project that you want to migrate between organization resources.\n- Project Mover (`roles/resourcemanager.projectMover`) on the project's parent resource (folder or organization resource).\n- **If the destination resource is a folder:** Project Mover (`roles/resourcemanager.projectMover`) on the destination resource.\n- **If the destination resource is an organization resource:** Project Creator (`roles/resourcemanager.projectCreator`) on the destination resource.\n\nThese roles give you the following required permissions: \n\n#### Required permissions\n\n- `resourcemanager.projects.getIamPolicy` on the project you want to migrate between organization resources\n- `resourcemanager.projects.update` on the project you want to migrate between organization resources\n- `resourcemanager.projects.move` on the project's parent resource (folder or organization resource)\n- **If the destination resource is a folder:** `resourcemanager.projects.move` on the destination resource\n- **If the destination resource is an organization resource:** `resourcemanager.projects.create` on the destination resource\n- **If you want to migrate a project that is not associated with an organization:** `resourcemanager.projects.setIamPolicy` on the project you want to migrate\n\nYou can also gain these permissions with a [custom\nrole](/iam/docs/creating-custom-roles), or other predefined roles.\n\n### Organization policy permissions\n\nOn the source and destination organization resources, the user setting the\norganization policies must have the `roles/orgpolicy.policyAdmin` role, which\ngrants permission to create and manage organization policies.\n\n### Billing account permissions\n\nCloud Billing accounts can be used across organization resources. Moving a\nproject from one organization resource to another won't impact billing, and\ncharges will continue against the old billing account. However, migration of projects between organization\nresources often also include a requirement to migrate to a new billing\naccount.\n\n\nTo get the permissions that\nyou need to change the project's billing account,\n\nask your administrator to grant you the\nfollowing IAM roles:\n\n- [Billing Account User](/iam/docs/roles-permissions/billing#billing.user) (`roles/billing.user`) on the destination billing account\n- [Project billing manager](/iam/docs/roles-permissions/billing#billing.projectManager) (`roles/billing.projectManager`) on the project\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nThese predefined roles contain\n\nthe permissions required to change the project's billing account. To see the exact permissions that are\nrequired, expand the **Required permissions** section:\n\n\n#### Required permissions\n\nThe following permissions are required to change the project's billing account:\n\n- ` billing.resourceAssociations.create` on the destination billing account\n- ` resourcemanager.projects.createBillingAssignment` on the project\n- ` resourcemanager.projects.deleteBillingAssignment` on the project\n\n\nYou might also be able to get\nthese permissions\nwith [custom roles](/iam/docs/creating-custom-roles) or\nother [predefined roles](/iam/docs/roles-overview#predefined).\n\nWhat's next\n-----------\n\nTo learn about how to configure organization policies, see [Configure organization policies](/resource-manager/docs/configure-org-policy)."]]
