Google Cloud Setup guided flow

An organization resource in Google Cloud represents your business, and serves as the top level node of your hierarchy. To create your organization, you set up a Google identity service and associate it with your domain. When you complete this process, an organization resource is automatically created.

For an overview of the organization resource, see the following:

• Manage organization resources.
• Best practices for planning accounts and organizations.

Who performs this task

The following two administrators perform this task:

• An identity administrator responsible for assigning role-based access. You assign this person as the Cloud Identity super administrator. For more information about the super administrator user, see Prebuilt administrator roles.

• A domain administrator with access to the company's domain host. This person edits your domain settings, such as DNS configurations, as part of the domain verification process.

What you do in this task

• If you haven't already, set up Cloud Identity, where you create a managed user account for your super administrator user.
• Link Cloud Identity to your domain (such as example.com).
• Verify your domain. This process creates the root node of your resource hierarchy, known as the organization resource.

Why we recommend this task

You must configure the following as part of your Google Cloud foundation:

• A Google identity service to centrally manage identities.
• An organization resource to establish the root of your hierarchy and access control.

Google identity service options

You use one or both of the following Google identity services to administer credentials for Google Cloud users:

• Cloud Identity: Centrally manages users and groups. You can federate identities between Google and other identity providers. For more information, see Overview of Cloud Identity.
• Google Workspace: Manages users and groups, and provides access to productivity and collaboration products like Gmail and Google Drive. For more information, see Google Workspace.

For detailed information about identity planning, see Planning the onboarding process for your corporate identities.

Before you begin

To understand how to manage a super administrator account, see Super administrator account best practices.

Configure an identity provider and verify your domain

The steps you complete in this task depend on whether you are a new or existing customer. Identify the option that fits your needs:

• New customer: Set up Cloud Identity, verify your domain, and create your organization.

• Existing Google Workspace customer: Use Google Workspace as your identity provider for users who access Google Workspace and Google Cloud. If you plan to create users who only access Google Cloud, enable Cloud Identity.

• Existing Cloud Identity customer: Verify your domain, make sure your organization was created, and confirm that Cloud Identity is enabled.

What's next

Create groups and add members.

In this task, you set up identities, users, and groups to manage access to Google Cloud resources.

For more information on access management on Google Cloud, see the following:

• Identity and Access Management (IAM) overview.
• For best practices, see Use IAM securely.

Who performs this task

You can perform this task if you have one of the following:

• The Google Workspace or Cloud Identity super administrator that you created in the Organization task.
• One of the following IAM roles:
  • Organization Administrator (roles/resourcemanager.organizationAdmin).
  • Workforce Identity Pool Admin (roles/iam.workforcePoolAdmin).

What you do in this task

• Connect to Cloud Identity or your external identity provider (IdP).

• Create administrative groups and users that will perform the remainder of the Google Cloud Setup steps. You grant access to these groups in a later task.

Why we recommend this task

This task helps you implement the following security best practices:

• Principle of least privilege: Give users the minimum permissions required to perform their role, and remove access as soon as it is no longer needed.

• Role-based access control (RBAC): Assign permissions to groups of users according to their job role. Do not add permissions to individual user accounts.

You can use groups to efficiently apply IAM roles to a collection of users. This practice helps you simplify access management.

Select an identity provider

You can use one of the following to manage users and groups, and connect them to Google Cloud:

• Google Workspace or Cloud Identity: You create and manage users and groups in Google Workspace or Cloud Identity. You can choose to synchronize with your external identity provider later.
• Your external identity provider, such as Microsoft Entra ID or Okta: You create and manage users and groups in your external identity provider. You then connect your provider to Google Cloud to enable single-sign-on.

To select your identity provider, do the following:

1. Sign in to the Google Cloud console as one of the users you identified in Who performs this task.

2. Go to Google Cloud Setup: Users & groups.

   Go to Users & groups

3. Review the task details and click Continue identity setup.

4. On the Select your identity provider page, select one of the following to begin a guided setup:

   • Use Google to centrally manage Google Cloud users: Use Google Workspace or Cloud Identity to provision and manage users and groups as a super administrator of your verified domain. You can later synchronize with your external identity provider.
   • Microsoft Entra ID (Azure AD): Use OpenID Connect to configure a connection to Microsoft Entra ID.
   • Okta: Use OpenID Connect to configure a connection to Okta.
   • OpenID Connect: Use the OpenID protocol to connect to a compatible identity provider.
   • SAML: Use the SAML protocol to connect to a compatible identity provider.
   • Skip setting up an external IdP for now: If you have an external identity provider and you're not ready to connect it to Google Cloud, You can create users and groups in Google Workspace or Cloud Identity.

5. Click Continue.

6. See one of the following for next steps:

   • Create users and groups in Cloud Identity
   • Connect your external identity provider to Google Cloud

Create users and groups in Cloud Identity

If you don't have an existing identity provider, or if you're not ready to connect your identity provider to Google Cloud, you can create and manager users and groups in Cloud Identity or Google Workspace. To create users and groups, you do the following:

• Create a group for each recommended administrative function, including organization, billing, and network administration.
• Create managed user accounts for administrators.
• Assign users to administrative groups that correspond to their responsibilities.

Before you begin

• Find and migrate users that already have Google Accounts. For detailed information, see Add users with unmanaged accounts.

• You must be a super administrator.

Create administrative groups

A group is a named collection of Google Accounts and service accounts. Each group has a unique email address, such as gcp-billing-admins@example.com. You create groups to manage users and apply IAM roles at scale.

The following groups are recommended to help you administer your organization's core functions and complete the Google Cloud Setup process.

To create administrative groups, do the following:

1. Select Google as your provider.

2. On the Create Groups page, review the list of recommended administrative groups, and then do one of the following:

   • To create all recommended groups, click Create all groups.
   • If you want to create a subset of the recommended groups, click Create in the chosen rows.

3. Click Continue.

Create administrative users

We recommend that you initially add users who complete organizational, networking, billing, and other setup procedures. You can add other users after you complete the Google Cloud Setup process.

To add administrative users who perform Google Cloud Setup tasks, do the following:

1. Migrate consumer accounts to managed user accounts controlled by Cloud Identity. For detailed steps, see the following:

   • Migrating consumer accounts.
   • Add users with unmanaged accounts.

2. Sign in to Google Admin console using a super administrator account.

3. Use one of the following options to add users:

   • To bulk add users, see Add or update multiple users from a CSV file.
   • To add users individually, see Add an account for a new user.

4. When you're done adding users, return to Google Cloud Setup: Users & groups (Create users).

5. Click Continue.

Add administrative users to groups

Add the users you created to administrative groups that correspond to their duties.

1. Make sure you created administrative users.

2. In Google Cloud Setup: Users & groups (Add users to groups), review the step details.

3. In each Group row, do the following:

   1. Click Add members.
   2. Enter the user's email address.

   3. From the Group role drop-down list, select the user's group permission settings. For more information, see Set who can view, post, and moderate.

      Each member inherits all IAM roles you grant to a group, regardless of the group role you select.

   4. To add another user to this group, click Add another member and repeat these steps. We recommend that you add more than one member to each group.

   5. When you're done adding users to this group, click Save.

4. When you're done with all groups, click Confirm users & groups.

5. If you want to federate your identity provider into Google Cloud, see the following:

   • Reference architectures: using an external IdP.
   • To automatically provision users and enable single sign-on, see the following:
     • Federate Cloud Identity with Active Directory.
     • Federate Cloud Identity with Microsoft Entra ID.
   • To sync Active Directory users and groups to Google Cloud, use Directory Sync or Google Cloud Directory Sync.
     • For a comparison, see Compare Directory Sync with GCDS.

Connect your external identity provider to Google Cloud

You can use your existing identity provider to create and manage groups and users. You configure single sign-on to Google Cloud by setting up workforce identity federation with your external identity provider. For key concepts of this process, see Workforce Identity Federation.

To connect your external identity provider, you complete a guided setup that includes the following steps:

1. Create a workforce pool: A workforce identity pool helps you manage identities and their access to resources. You enter the following details in a human-readable format.
   • Workforce pool ID: A globally unique identifier used in IAM.
   • Provider ID: A name for your provider, which users will specify when they log in to Google Cloud.
2. Configure Google Cloud in your provider: The guided setup includes specific steps for your provider.
3. Enter your provider's workforce pool details: To add your provider as a trusted authority to assert identities, retrieve details from your provider and add them to Google Cloud:
4. Configure an initial set of administrative groups: The guided setup includes specific steps for your provider. You assign groups in your provider and establish a connection to Google Cloud. For a detailed description of each group, see Create administrative groups.
5. Assign users to each group: We recommend that you assign more than one user to each group.

For background information on the connection process for each provider, see the following:

• Configure Workforce Identity Federation with Azure AD and sign in users.
• Configure Workforce Identity Federation with Okta and sign in users
• For other providers that support OIDC or SAML, see Configure Workforce Identity Federation

What's next

Assign permissions to your administrator groups.

In this task, you use Identity and Access Management (IAM) to assign collections of permissions to groups of administrators at the organization level. This process gives administrators central visibility and control over every cloud resource that belongs to your organization.

For an overview of Identity and Access Management in Google Cloud, see IAM overview.

Who performs this task

To perform this task, you must be one of the following:

• A super administrator user.
• A user with the Organization Administrator role (roles/resourcemanager.organizationAdmin).

What you do in this task

• Review a list of default roles assigned to each administrator group that you created in the Users and groups task.

• If you want to customize a group, you can do the following:

  • Add or remove roles.
  • If you do not plan to use a group, you can delete it.

Why we recommend this task

You must explicitly grant all administrative roles for your organization. This task helps you implement the following security best practices:

• Principle of least privilege: Give users the minimum permissions required to perform their jobs, and remove access as soon as it is no longer needed.

• Role-based access control (RBAC): Assign permissions to groups of users according to their jobs. Do not grant roles to individual user accounts.

Before you begin

Complete the following tasks:

• Create a super administrator user and your organization in the Organization task.
• Add users and create groups in the Users and groups task.

Grant access to administrator groups

To grant appropriate access to each administrator group that you created in the Users and groups task, review the default roles that are assigned to each group. You can add or remove roles to customize each group's access.

1. Make sure that you are logged in to the Google Cloud console as a super administrator user.

   Alternatively, you can sign in as a user with the Organization Administrator role (roles/resourcemanager.organizationAdmin).

2. Go to Google Cloud Setup: Administrative access.

   Go to Administrative access

3. Select your organization name from the Select from drop-down list at the top of the page.

4. Review the task overview and click Continue administrative access.

5. Review the groups in the Group (Principal) column that you created in the Users & groups task.

6. For each group, review the default IAM roles. You can add or remove roles assigned to each group to fit the unique needs of your organization.

   Each role contains multiple permissions that allow users to perform relevant tasks. For more information about the permissions in each role, see IAM basic and predefined roles reference.

7. When you are ready to assign roles to each group, click Save and grant access.

What's next

Set up billing.

In this task, you set up a billing account to pay for Google Cloud resources. To do this, you associate one of the following with your organization.

• An existing Cloud Billing account. If you don't have access to the account, you can request access from your billing account administrator.

• A new Cloud Billing account.

For more information on billing, see the Cloud Billing documentation.

Who performs this task

A person in the gcp-billing-admins@YOUR_DOMAIN group that you created in the Users and groups task.

What you do in this task

• Create or use an existing self-serve Cloud Billing account.
• Decide whether to transition from a self-serve account to an invoiced account.
• Set up a Cloud Billing account and payment method.

Why we recommend this task

Cloud Billing accounts are linked to one or more Google Cloud projects and are used to pay for the resources you use, such as virtual machines, networking, and storage.

Determine your billing account type

The billing account that you associate with your organization is one of the following types.

• Self-serve (or online): Sign up online using a credit or debit card. We recommend this option if you are a small business or individual. When you sign up online for a billing account, your account is automatically set up as a self-serve account.

• Invoiced (or offline). If you already have a self-serve billing account, you might be eligible to apply for invoiced billing if your business meets eligibility requirements.

You cannot create an invoiced account online, but you can apply to convert a self-serve account to an invoiced account.

For more information, see Cloud Billing account types.

Before you begin

Complete the following tasks:

• Create a super administrator user and your organization in the Organization task.
• Add users and create groups in the Users and groups task.
• Assign IAM roles to groups in the Administrative access task.

Set up the billing account

Now that you have chosen a billing account type, associate the billing account with your organization. When you complete this process, you can use your billing account to pay for Google Cloud resources.

1. Sign in to the Google Cloud console as a user from the gcp-billing-admins@YOUR_DOMAIN group.

2. Go to Google Cloud Setup: Billing.

   Go to Billing

3. Review the task overview, and then click Continue billing.

4. Select one of the following billing account options:

   Create a new account

   If your organization does not have an existing account, create a new account.

   1. Select I want to create a new billing account.
   2. Click Continue.

   3. Select the billing account type you want to create. For detailed steps, see the following:

      • To create a new self-serve account, see Create a new self-serve Cloud Billing account.
      • To transition an existing self-serve account to invoiced billing, see Apply for monthly invoiced billing.

   4. Verify that your billing account was created:

      1. If you created an invoiced account, wait up to 5 business days to receive email confirmation.

      2. Go to the Billing page.

      3. Select your organization from the Select from list at the top of the page. If the account was created successfully, it is displayed in the billing account list.

   Use my existing account

   If you have an existing billing account, you can associate it with your organization.

   1. Select I identified a billing account from this list that I would like to use to complete the setup steps.
   2. From the Billing drop-down list, select the account you want to associate with your organization.
   3. Click Continue.
   4. Review the details and click Confirm billing account.

   Use another user's account

   If another user has access to an existing billing account, you can ask that user to associate the billing account with your organization, or the user can give you access to complete the association.

   1. Select I want to use a billing account that's managed by another Google user account.
   2. Click Continue.
   3. Enter the billing account administrator's email address.
   4. Click Contact administrator.
   5. Wait for the billing account administrator to contact you with further instructions.

What's next

Create a resource hierarchy and assign access.

In this task, you set up your resource hierarchy by creating and assigning access to the following resources:

Folders

Provide a grouping mechanism and isolation boundaries between projects. For example, folders can represent departments in your organization such as finance or retail.

The environment folders, such as Production, in your resource hierarchy are configured for application management. You can define and manage applications in these folders.

Projects

Contain your Google Cloud resources, such as virtual machines, databases and storage buckets. Each of the environment folders also contains a management project, which helps you manage access, billing, observability and other administrative functions for your applications.

For design considerations and best practices to organize your resources in projects, see Decide a resource hierarchy for your Google Cloud landing zone.

Who performs this task

A person in the gcp-organization-admins@YOUR_DOMAIN group that you created in the Users and groups task can perform this task.

What you do in this task

• Create an initial hierarchy structure that includes folders and projects.
• Set IAM policies to control access to your folders and projects.

Why we recommend this task

Creating a structure for folders and projects helps you manage Google Cloud resources and applications. You can use the structure to assign access based on the way your organization operates. For example, you might organize and provide access based on your organization's unique collection of geographic regions, subsidiary structures, or accountability frameworks.

Plan the resource hierarchy

Your resource hierarchy helps you create boundaries, and share resources across your organization for common tasks. You create your hierarchy using one of the following initial configurations, based on your organization structure:

• Simple environment-oriented:

  • Isolate environments like Non-production and Production.
  • Implement distinct policies, regulatory requirements, and access controls in each environment folder.
  • Good for small companies with centralized environments.

• Simple team-oriented:

  • Isolate teams like Development and QA.
  • Isolate access to resources using child environment folders under each team folder.
  • Good for small companies with autonomous teams.

• Environment-oriented:

  • Prioritize the isolation of environments like Non-production and Production.
  • Under each environment folder, isolate business units.
  • Under each business unit, isolate teams.
  • Good for large companies with centralized environments.

• Business unit-oriented:

  • Prioritize the isolation of business units like Human Resources and Engineering to help ensure that users can only access the resources and data they need.
  • Under each business unit, isolate teams.
  • Under each team, isolate environments.
  • Good for large companies with autonomous teams.

Each configuration has a Common folder for projects that contain shared resources. This might include logging and monitoring projects.

Before you begin

Complete the following tasks:

• Create a super administrator user and your organization in the Organization task.
• Add users and create groups in the Users and groups task.
• Assign IAM roles to groups in the Administrative access task.
• Create or link a billing account in the Billing task.

Configure initial folders and projects

Select the resource hierarchy that represents your organization structure.

To configure initial folders and projects, do the following:

1. Sign in to the Google Cloud console as a user from the gcp-organization-admins@YOUR_DOMAIN group you created in the Users and groups task.

2. Select your organization from the Select from drop-down list at the top of the page.

3. Go to Google Cloud Setup: Hierarchy & access.

   Go to Hierarchy & access

4. Review the task overview, and then click Start next to Resource hierarchy.

5. Select a starting configuration.

6. Click Continue and configure.

7. Customize your resource hierarchy to reflect your organizational structure. For example, you can customize the following:

   • Folder names.

   • Service projects for each team. To grant access to service projects, you can create the following:

     • A group for each service project.
     • Users in each group.

     For an overview of service projects, see Shared VPC.

   • Projects required for monitoring, logging, and networking.

   • Custom projects.

8. Click Continue.

9. Grant access to your folders and projects.

Grant access to your folders and projects

In the Administrative access task, you granted administrative access to groups at the organization level. In this task, you configure access to groups that interact with your newly configured folders and projects.

Projects, folders, and organizations each have their own IAM policies, which are inherited through the resource hierarchy:

• Organization: Policies apply to all folders and projects in the organization.
• Folder: Policies apply to projects and other folders within the folder.
• Project: Policies apply only to that project and its resources.

Update the IAM policies for your folders and projects:

1. In the Configure access control section of Hierarchy & access, grant your groups access to your folders and projects:

   1. In the table, review the list of recommended IAM roles granted to each group for each resource.

   2. If you want to modify the roles assigned to each group, click Edit in the desired row.

      For more information about each role, see IAM basic and predefined roles.

2. Click Continue.

3. Review your changes and click Confirm draft configuration.

Configure billing for management projects

After you deploy your configuration, you must configure billing for each management project. The billing account is required to pay for APIs that have associated costs. For more information, see Link a billing account for the management project.

What's next

Configure security settings.

In this task, you configure security settings and products to help protect your organization.

Who performs this task

You must have one of the following to complete this task:

• The Organization Administrator role (roles/resourcemanager.organizationAdmin).
• Membership in one of the following groups that you created in the Users and groups task:
  • gcp-organization-admins@<your-domain>.com
  • gcp-security-admins@<your-domain>.com

What you do in this task

Apply recommended organization policies based on the following categories:

• Access management.
• Service account behavior.
• VPC network configuration.
• Cloud KMS with Autokey—only available for the Enhanced security foundation option.

You also enable Security Command Center to centralize vulnerability and threat reporting.

Additionally, we recommend that you configure Essential Contacts to help security and operational teams receive critical alerts.

Why we recommend this task

Applying recommended organization policies helps you limit user actions that don't align with your security posture.

Enabling Security Command Center helps you create a central location to analyze vulnerabilities and threats.

Enforcing and automating Cloud KMS with Autokey helps you use customer-managed encryption keys (CMEKs) consistently to protect your resources.

Before you begin

Complete the following tasks:

• Create a super administrator user and your organization in the Organization task.
• Add users and create groups in the Users and groups task.
• Assign IAM roles to groups in the Administrative access task.

Start the security task

1. Sign in to the Google Cloud console with a user you identified in Who performs this task.

2. Select your organization from the Select from drop-down at the top of the page.

3. Go to Google Cloud Setup: Security.

   Go to Security

4. Review the task overview, and then click Start Security.

Centralize vulnerability and threat reporting

To centralize vulnerability and threat reporting services, enable Security Command Center. This helps you strengthen your security posture and mitigate risks. For more information, see Security Command Center overview.

1. On the Google Cloud Setup: Security page, make sure that the Enable Security Command Center: Standard checkbox is enabled.

   This task enables the free Standard tier. You can upgrade to the Premium version at a later time. For more information, see Security Command Center service tiers.

2. Click Apply SCC settings.

Apply recommended organization policies

Organization policies apply at the organization level, and are inherited by folders and projects. In this task, review and apply the list of recommended policies. You can modify organization policies at any time. For more information, see Introduction to the Organization Policy Service.

1. Review the list of recommended organization policies. If you don't want to apply a recommended policy, click its checkbox to remove it.

   For a detailed explanation of each organization policy, see Organization policy constraints.

2. Click Confirm organization policy configurations.

The organization policies that you select are applied when you deploy your configuration in a later task.

Enforce and automate customer encryption keys

Cloud KMS with Autokey lets developers in your organization create symmetric encryption keys when required to protect your Google Cloud resources. You can configure Cloud KMS with Autokey if you selected the Enhanced security foundation option.

1. Review the description of Cloud KMS with Autokey, and then for Use Cloud KMS with Autokey and apply organizational policies, click Yes (recommended).
2. Click Confirm key management configuration.

The following configurations are applied when you deploy your configuration in a later task:

• Set up an Autokey project in each environment folder of your hierarchy.
• Enable Cloud KMS with Autokey on the environment folders.
• Require the use of customer managed encryption keys (CMEKs) for resources created in each environment folder.
• Restrict each folder to only use Cloud KMS keys in the Autokey project for that folder.

Configure organizational notification contacts

You can configure organizational notification contacts to make sure that security and operational alerts reach the correct team.

To help the appropriate teams receive these critical alerts promptly, configure custom contacts using Essential Contacts.

What's next

Central logging and monitoring.