Question

Your company has just created its first Google Cloud organization resource that was automatically provisioned when a Cloud Identity super admin logged in. The platform team needs to bootstrap organization-level administration so that a dedicated group (gcp-org-admins@yourco.com) can manage IAM, create folders, and set org policies — without relying on the Cloud Identity super admin for day-to-day operations. What is the recommended first step to establish this delegated administration securely?

Accepted Answer

Have the Cloud Identity super admin grant the Organization Administrator (roles/resourcemanager.organizationAdmin) role at the organization node to the gcp-org-admins group, then use that group to assign further granular roles.

Answer

Grant the gcp-org-admins group the Owner (roles/owner) role on every existing project so they inherit organization-wide control.

Answer

Add each member of the platform team to the Cloud Identity super admin role so they can administer the organization directly.

Answer

Create a service account with the Organization Administrator role and share its exported key with the platform team for org-level changes.