All projects created after the creation of the Organization resource will
automatically belong to the Organization resource. You can migrate a project
into an organization using the Cloud Console, the
Resource Manager API, or the gcloud
command-line tool.
Migrating projects in an organization
If a project is associated with an organization, you can't change it back to No organization or migrate it to another organization without involving Google Cloud support. If you need to migrate a project after it's associated with an organization, see Migrating Projects to another Organization.
Migrating projects with no organization
To migrate a project using the API or the gcloud
tool, you will need
the following permissions:
resourcemanager.projects.create
on the destination organization, typically granted by the Project Creator role.resourcemanager.projects.update
andresourcemanager.projects.setIAMPolicy
on the project you are migrating, typically granted by the Owner role.
To migrate a project using the Google Cloud Console, you will also need the
resourcemanager.organizations.get
permission on the destination organization.
If you are missing any of these permissions, the destination organization will
not appear in the Google Cloud Console.
Project migration isn't reversible. After a project is associated with an organization, you can't change it back to No organization or move it to another organization on your own. If you want to move a project after it's associated with an organization, contact Google Cloud Support.
Console
To migrate a project into an organization:
Open the IAM & admin > Settings page in the Cloud Console.
Select the Project picker at the top of the page.
From the Organization picker, select No Organization. If you are not associated with any organization, the Organization picker will not appear, and you can skip this step.
Select the project you want to migrate.
At the top of the page, click Migrate.
On the Organization drop-down list, select the organization you want to migrate your project to.
After a project is added to an organization, you cannot undo the selection on your own.
gcloud
To migrate a project into an organization, run the following command:
gcloud alpha projects move PROJECT_ID / --organization ORGANIZATION_ID
Where:
- PROJECT_ID is the ID of the project you wish to move into the organization.
- ORGANIZATION_ID is the ID of the organization to which you wish to move the project.
After a project is added to an organization, you cannot undo the selection on your own.
API
Using the Resource Manager API, you can move a project into the organization
resource by setting its parent
field to the organization ID of the
organization.
To migrate a project into the organization:
- Get the
project
object usingprojects.get()
method. - Set its
parent
field to the Organization ID of the organization. - Update the
project
object usingprojects.update()
method.
You can't change the parent
field after you set it.
The following code snippet demonstrates the steps above:
project = crm.projects().get(projectId=flags.projectId).execute()
project['parent'] = {
'type': 'organization',
'id': flags.organizationId
}
project = crm.projects().update(
projectId=flags.projectId, body=project).execute()
Note on policy implications
IAM policies that are already defined for a project are imported with the project. This means users who have permissions on a project before it moves maintain the permissions after the project is migrated into the organization.
IAM permissions are inherited and additive; if there are roles defined at the organization level, those roles are inherited by the projects as they are moved into the organization. If, for example, bob@myorganization.com has the Project Editor role defined at the organization level, he will also have this role on any project migrated into the organization. This does not break anything in existing projects, but more users may gain access due to inheritance.
Similarly, organization policies are also inherited down the hierarchy. By default no organization policy is defined for an organization when it is created. If you have subsequently defined organization policies on your organization, care needs to be taken when moving projects into the organization to make sure projects are consistent with such policies.
Migrating existing billing accounts
If you are a Google Workspace or Cloud Identity customer with existing Cloud Billing accounts, you can migrate them to your organization. Migrating a Cloud Billing account into an Organization doesn't affect project services.
You must have these roles to migrate billing accounts:
- You must be a Billing Account Administrator for the Cloud Billing account that you want to migrate.
- You must be a Billing Account Creator on the organization to which you want to migrate your Cloud Billing account.
- If you want to migrate a Cloud Billing account from an existing organization, you must be a Billing Account Administrator for the organization that you are migrating the Cloud Billing account from.
To learn about granting these roles, see the Overview of Cloud Billing access control.
To migrate your existing billing accounts into an organization, follow the steps below:
-
Go to the Cloud Console Billing page:
Go to the Billing page - From the Select an organization menu, select an organization to see the Cloud Billing accounts associated with it, or select No organization to see billing accounts that aren't associated with an organization.
- Under Billing account name, click the name of the Cloud Billing account that you want to migrate. The billing account overview page opens.
- In the Billing navigation menu, click Account management.
- At the top of the Account management page, click Change Organization, then select the organization to which you want to migrate the Cloud Billing account.