This page explains how to view and manage your Google Cloudresources, grant Identity and Access Management (IAM) roles at the organizationlevel, and manage organization resource billing accounts using theGoogle Cloud console.

Before you begin

1. Make sure that you have anorganization resource.

   An organization resource is available for Google Workspace and Cloud Identity customers:

   • Google Workspace: Sign up forGoogle Workspace.
   • Cloud Identity: Sign up forCloud Identity.

   Once you have created your Google Workspace or Cloud Identity account and associated it with a domain, your organization resource will be automatically created for you. The resource will be provisioned at different times depending on your account status:

   • If you are new to Google Cloud and have not created a project yet, the organization resource will be created for you when you log in to the Google Cloud console and accept the terms and conditions.

   • If you are an existing Google Cloud user, the organization resource will be created for you when you create a new project or billing account. Any projects you created previously will be listed under "No organization", and this is normal. The organization resource will appear and the new project you created will be linked to it automatically.

     You will need to move any projects you created under "No organization" into your new organization resource. For instructions on how to move your projects, seeMigrating projects into an organization resource.

   The organization resource that is created will be linked to your Google Workspace or Cloud Identity account with the project or billing account you created set as a child resource. All projects and billing accounts created under your Google Workspace or Cloud Identity domain will be children of this organization resource.

   • For information about how to migrate pre-existing projects, seeMigrating existing projects.

   Each Google Workspace or Cloud Identity account is associated with exactly one organization resource. An organization resource is associated with exactly one domain, which is set when the organization resource is created.

2. Make sure that you have the Organization Administrator role on the organization resource.

   If you're the Super Admin of your Google Workspace domain account, you canadd yourself and others as the Organization Administrator of the correspondingorganization resource. For instructions on adding Organization Administrators, seeAdding an organization administrator.

3. Make sure that you have the following role or roles on the organization: Billing Account Creator, Folder Creator, Project Creator

   Check for the roles

   1. In the Google Cloud console, go to theIAM page.

      Go to IAM
   2. Select the organization.

   3. In thePrincipal column, find all rows that identify you or a group that you're included in. To learn which groups you're included in, contact your administrator.

   4. For all rows that specify or include you, check theRole column to see whether the list of roles includes the required roles.

   Grant the roles

   1. In the Google Cloud console, go to theIAM page.

      Go to IAM
   2. Select the organization.
   3. Clickperson_addGrant access.

   4. In theNew principals field, enter your user identifier. This is typically the email address for a Google Account.

   5. ClickSelect a role, then search for the role.
   6. To grant additional roles, clickaddAdd another role and add each additional role.
   7. ClickSave.

View your resources

To view your Google Cloud resources, follow the steps below:

1. Go to the Google Cloud consoleManage resources page.
   Go to Manage Resources
2. On the dropdown at the top of the page, select the organization resource for which you want to manage resources.
3. All Projects and Folders in the organization resource are listed on the page.

Create a Project resource

To create a new project, do the following:

1. Go to theManage resources page in the Google Cloud console.

   Go to Manage Resources

   The remaining steps appear in the Google Cloud console.

2. On theSelect organization drop-down list at the top of the page, select the organization resource in which you want to create a project. If you are a free trial user, skip this step, as this list does not appear.
3. ClickCreate Project.
4. In theNew Project window that appears, enter a project name and select a billing account as applicable. A project name can contain only letters, numbers, single quotes, hyphens, spaces, or exclamation points, and must be between 4 and 30 characters.
5. Enter the parent organization or folder resource in theLocation box. That resource will be the hierarchical parent of the new project. IfNo organization is an option, you can select it to create your new project as the top level of its own resource hierarchy.
6. When you're finished entering new project details, clickCreate.

Once you have created your first Project, your organization resource will beprovisioned automatically.

Create a Folder resource

Once you have an organization resource, you can create Folder resources andbegin to organize your resource hierarchy. To create a Folder in yourorganization resource, follow the steps below:

1. Go to the Google Cloud consoleManage resources page.
   Go to Manage Resources
2. On the dropdown at the top of the page, select the organization resource for which you want to create a Folder resource.
3. ClickCreate Folder.
4. In theCreate Folder window that appears, enter a Folder name.
5. If you want to create the Folder resource inside a Folder that alreadyexists, enter the parent Folder name in theDestination box.
6. When you're finished entering new Folder details, clickCreate.

Grant IAM roles at the organization level

To grant organization-level roles, follow the steps below:

1. Go to the Google Cloud consoleIAM & admin page:
   Go to IAM & Admin

2. ClickSelect, then use the drop-down to select the organization resource forwhich you want to manage IAM permissions.

   1. In the list of resources that appears, click the name of the organization resource.
   2. TheIAM page that appears shows the following details:
      • ThePrincipals column shows the accounts that have roles in theorganization resource, including your account and domain.
      • TheRole(s) column shows the roles that each principal has.
        • Next to your account, you should seeOrganization AdministratorunderRole(s).
        • Next to the domain account, you should seeProject Creator underRoles(s).
        • If you seeMultiple underRole(s), the account has more thanone role. Click the drop-down to see what roles a principal has.
   3. To grant roles to an existing principal, click the drop-down underRole(s) and then select each role you want the principal to have.
      1. When you're finished selecting roles, clickSave.
   4. To add a new principal, clickAdd at the top of the page. In theAddprincipals dialog that appears:
      1. Enter an email address in thePrincipals box.
      2. UnderRoles, select each role you want the principal to have.
      3. When you're finished selecting roles, clickAdd.

The principals you added now have the organization-level permissions youselected.

Create a billing account

1. Go to the Google Cloud consoleBilling page:
   GO TO THE BILLING PAGE
2. In the drop-down at the top of the page, select the organization resource for which you want to add a billing account.
3. ClickCreate account.
4. On theCreate a new billing account window that appears, enter theappropriate details, including a billing account name and your billinginformation.
   • The options you see depend on the country of your billing address.
   • For United States accounts, you can't change tax status after you createthe billing account.
5. When you're finished entering details, clickSubmit and enable billing.

You've now created a new billing account for your organization resource.

Migrate existing billing accounts

If you are a Google Workspace or Cloud Identity customer with existing Cloud Billing accounts, you can migrate them to your organization resource. Migrating a Cloud Billing account into an organization resource doesn't affect project services.

You must have these roles to migrate billing accounts:

• You must be aBilling Account Administrator for the Cloud Billing account that you want to migrate.
• You must be aBilling Account Creator on the organization resource to which you want to migrate your Cloud Billing account.
• If you want to migrate a Cloud Billing account from an existing organization resource, you must be aBilling Account Administrator for the organization resource that you are migrating the Cloud Billing account from.

To learn about granting these roles, see theOverview of Cloud Billing access control.

To migrate your existing billing accounts into an organization resource, follow the steps below:

1. Go to the Google Cloud consoleBilling page:
   Go to the Billing page
2. From theSelect an organization menu, select an organization resource to see the Cloud Billing accounts associated with it, or selectNo organization to see billing accounts that aren't associated with an organization resource.
3. UnderBilling account name, click the name of the Cloud Billing account that you want to migrate. The billing account overview page opens.
4. In the Billing navigation menu, clickAccount management.
5. At the top of the Account management page, clickbusinessChange Organization, then select the organization resource to which you want to migrate the Cloud Billing account.

View billing accounts under the organization resource

To view billing accounts under an organization resource, follow the steps below:

1. Go to the Google Cloud consoleBilling page:
   GO TO THE BILLING PAGE
2. In the drop-down at the top of the page, select the organization resourcefor which you want to view billing accounts.

All billing accounts for the organization resource are listed on the page.

Clean up

To delete the Project you just created for this quickstart:

1. Go to the Google Cloud consoleManage resourcespage.

   Go to Manage Resources

   1. In the drop-down at the top of the page, select the organization resourcein which you want to delete Project resources.
   2. In the list of Project resources that appears, select the Project that youwant to delete, then clickDelete.
   3. On theShut down project dialog that appears, enter the Project ID,then clickShut down.

The Project resources you selected are deleted and all billing and trafficserving stops.

The organization resource is bound to your Google Workspace or Cloud Identityaccount, and deleting it is potentially a very damaging action that might beimpossible to fully reverse. For more information, seeDeleting an organization resource.

What's next

• TryMigrating existing projects into the organization resource.
  • You don't have to move all your Project resources at the same time.
  • It's best to start by moving a test Project first, and then move the restof the Projects later.
• Learn more about the organization resource.