Google Cloud Organization Setup with Cloud Identity Free - Create an Org and Move Your Projects Under It

When I started the Shared VPC lab I hit a wall on the very first command - gcloud compute shared-vpc enable simply does not work on a standalone project. Shared VPC, Organization Policies, folders, hierarchical firewall policies and org-level IAM all need one thing first - a Google Cloud Organization. And most of us who started with a personal Gmail account and a couple of projects do not have one.

So in this blog post we are going to give a domain (I am using my own, jhooq.com) a Google Cloud Organization using Cloud Identity Free - no cost and no Google Workspace subscription - verify the domain, and move the existing projects under the new organization. Everything after the org exists is scriptable with gcloud and Terraform, and I will show both.

Table of Content

1. What is a Google Cloud Organization and why do you need one?
2. Three things to know before you start
3. Build it step by step (diagrams and commands for every step)
4. The complete walkthrough - Cloud Identity signup, domain verification, gcloud
5. Terraform - reference the organization, grant IAM, create folders
6. Common problems
7. Conclusion and what to read next

1. What is a Google Cloud Organization and why do you need one?

A Google Cloud Organization is the root of the resource hierarchy - the parent node above all your folders and projects. You do not create it directly. It is provisioned automatically the moment you set up Cloud Identity (or Google Workspace) for a domain you own.

Here is the resource hierarchy with and without an organization -

1# without an organization (what most personal accounts look like)
2Project: cl-demo-sandbox
3Project: cl-demo-sandboxcli          # standalone, no parent
4
5# with an organization
6Organization: jhooq.com (123456789012)
7├── Folder: prod
8│   └── Project: cl-demo-sandbox
9└── Project: cl-demo-sandboxcli

Once the organization exists, it unlocks the whole governance layer, none of which works on standalone projects -

1. Shared VPC - one host project lends its network to service projects. Needs an org, full stop.
2. Organization Policies - constraints like "no public IPs on VMs" or "no service account keys" enforced on every project below.
3. Folders - group projects by team or environment, and grant IAM once at the folder level.
4. Hierarchical firewall policies - firewall rules enforced from the org or folder down.
5. Org-level IAM, logging and billing export - one place to see and control everything.

If you only have one project and no plans to share networks, you do not need an organization. The moment there is a second team, a second environment or a compliance requirement, you do.

2. Three things to know before you start

1. Your email is safe. Cloud Identity Free does not host email. As long as you do not change your domain's MX records, your existing mailboxes keep working exactly as before. The admin account you create is a login identity only, it has no mailbox.

2. Use a dedicated super-admin, for example admin@yourdomain.com, not your everyday login. It keeps the org owner clean, and it avoids the "unmanaged account" tangle where your personal Google account and the organization account fight over the same email address.

3. The signup and domain verification are console and DNS steps, not gcloud or Terraform. But everything after the org exists - IAM, moving projects, folders, policies - is fully scriptable.

3. Build it step by step (diagrams and commands for every step)

Six steps - the first two are in the browser (Cloud Identity signup and the DNS record), the rest are gcloud. Click a step in the rail or use Prev / Next or the arrow keys, and click a diagram to zoom.

# UI step — a console signup wizard, not gcloud. Use the DIRECT link so you
# land on the FREE edition (not a paid Workspace trial):
#   → workspace.google.com/gcpidentity/signup
#
#   1. Business details  → domain: jhooq.com
#   2. Create admin account → admin@jhooq.com  (+ strong password)  ← must finish
#   3. Add a recovery email/phone (super-admin can't be recovered without it)
#
# 💡 Cloud Identity Free = $0, up to 50 users, gives you the Organization node.
# ⚠️ Skip the 14-day Workspace trial if the funnel offers it.
# ⚠️ do NOT change jhooq.com MX records — Cloud Identity Free doesn't host email.

# add the TXT record Google gives you, at SiteGround DNS:
#   TXT  @  google-site-verification=XXXXXXXXXXXX
dig TXT jhooq.com +short

# GCP auto-provisions the org once the domain verifies
gcloud organizations list
ORG_ID=$(gcloud organizations list --format="value(ID)")

# the org already exists — just read it
data "google_organization" "org" {
  domain = "jhooq.com"
}

gcloud organizations add-iam-policy-binding "$ORG_ID" \
  --member="user:admin@jhooq.com" \
  --role="roles/resourcemanager.organizationAdmin"

resource "google_organization_iam_member" "admin" {
  org_id = data.google_organization.org.org_id
  role   = "roles/resourcemanager.organizationAdmin"
  member = "user:admin@jhooq.com"
}

gcloud beta projects move cl-demo-sandbox    --organization="$ORG_ID"
gcloud beta projects move cl-demo-sandboxcli --organization="$ORG_ID"

# a NEW project can be created directly under the org:
resource "google_project" "demo" {
  name            = "cl-demo-sandbox"
  project_id      = "cl-demo-sandbox"
  org_id          = data.google_organization.org.org_id
  billing_account = "YOUR_BILLING_ACCOUNT_ID"
}
# existing standalone projects: use `gcloud beta projects move` (above),
# then reconcile org_id in code.

gcloud projects list --filter="parent.id=$ORG_ID" \
  --format="table(projectId, parent.type, parent.id)"
gcloud organizations describe "$ORG_ID"

4. The complete walkthrough - Cloud Identity signup, domain verification, gcloud

Steps 1 and 2 are a console wizard plus one DNS record (the org cannot be created by gcloud). Everything after that is a command.

1# record to add at your DNS provider:  TXT  @  google-site-verification=XXXXXXXXXXXX
2dig TXT jhooq.com +short

1gcloud organizations list
2# DISPLAY_NAME   ID              DIRECTORY_CUSTOMER_ID
3# jhooq.com      123456789012    C0abcd123
4
5ORG_ID=$(gcloud organizations list --format="value(ID)")

1gcloud organizations add-iam-policy-binding "$ORG_ID" \
2  --member="user:admin@jhooq.com" \
3  --role="roles/resourcemanager.organizationAdmin"

1gcloud beta projects move cl-demo-sandbox    --organization="$ORG_ID"
2gcloud beta projects move cl-demo-sandboxcli --organization="$ORG_ID"

1gcloud projects list --filter="parent.id=$ORG_ID" \
2  --format="table(projectId, parent.type, parent.id)"
3gcloud organizations describe "$ORG_ID"

5. Terraform - reference the organization, grant IAM, create folders

The signup and the domain verification cannot be Terraformed, Google provisions the org for you. But everything after the org exists is code - read the org with a data source, grant IAM, create folders and place projects. If you are new to Terraform on Google Cloud, my post on deploying to Google Cloud Run with Terraform covers setting up the provider and a deployer service account.

1provider "google" {
2  region = "europe-north2"
3}

 1# the org already exists (created by Cloud Identity) — just read it
 2data "google_organization" "org" {
 3  domain = "jhooq.com"
 4}
 5
 6resource "google_organization_iam_member" "admin" {
 7  org_id = data.google_organization.org.org_id
 8  role   = "roles/resourcemanager.organizationAdmin"
 9  member = "user:admin@jhooq.com"
10}

1resource "google_project" "demo" {
2  name            = "cl-demo-sandbox"
3  project_id      = "cl-demo-sandbox"
4  org_id          = data.google_organization.org.org_id
5  billing_account = "YOUR_BILLING_ACCOUNT_ID"
6}

1resource "google_folder" "prod" {
2  display_name = "prod"
3  parent       = data.google_organization.org.name   # organizations/<ORG_ID>
4}

6. Common problems

1. The signup wants to start a Google Workspace trial - Use the direct Cloud Identity link from step 1. If the funnel asks whether your business already uses Gmail, pick the option that keeps you on Cloud Identity. You do not need Workspace for an organization.

2. "An account with this email already exists" - Somebody (probably you, years ago) created a consumer Google account with an address on your domain. The wizard offers a conflicting-account transfer tool to claim it. Do that before continuing, otherwise you end up with an unmanaged account outside the org.

3. Domain verification never completes - The TXT record is not published yet or you added it on the wrong name. It has to be on the apex (@), and dig TXT yourdomain.com +short must show the google-site-verification=... value. DNS propagation can take up to an hour.

4. gcloud organizations list is empty - You are logged in with your personal account, not the new super-admin. Run gcloud auth login admin@yourdomain.com.

5. gcloud beta projects move fails with a permission error - The super-admin needs roles/resourcemanager.organizationAdmin on the org (step 4) and roles/resourcemanager.projectMover or Owner on the project being moved. A project created under your personal account has your personal account as Owner, not the new admin - grant the admin Owner on the project first.

6. The project is under the org but Shared VPC still fails - Both the host and the service project must be under the same organization. Check with gcloud projects get-ancestors <project-id>.

7. Conclusion and what to read next

Creating a Google Cloud Organization is a one-time, free setup, and it is the step which turns a pile of personal projects into something you can govern. To summarise -

1. Cloud Identity Free gives you the Organization node at no cost - you do not need Google Workspace.
2. Keep your MX records untouched and use a dedicated super-admin account.
3. Once the org exists, grant organizationAdmin, move your projects with gcloud beta projects move, and manage the rest in Terraform.

Now that you have an organization, the next post in the series is the one this was all for - Google Cloud Shared VPC - one network, many projects.

The Google Cloud networking series -

1. Google Cloud VPC peering - hub and spoke
2. Google Cloud cross-project VPC peering
3. Google Cloud Organization setup with Cloud Identity (this post)
4. Google Cloud Shared VPC - one network, many projects
5. Google Cloud Private Service Connect - publish one service privately