When you start creating your Cloud environment, you need to establish who in your company can have permission to create, access, modify, and destroy Cloud resources. There are a few key IAM roles that we recommend paying close attention to. The organization admin role is responsible for defining IAM policies, determining the resource hierarchy, and delegating responsibilities over critical components. It's worth mentioning that you only get an organization note, folder structure, and an organization admin if you import your domain to Cloud Identity or G Suite. Having an organization in GCP is not mandatory for Virtual Machine Migration. However, it is recommended for scalability reasons. The network admin role equips your network engineer with permissions to create, modify, and delete network topologies and resources like whole VPCs, subnets, and network resources like cloud router, load balances, etc. Because firewall and SSL certificates are sensitive and security-related, the network admin only has read access to these resources. The security admin role contains permissions to create, modify, and delete firewall rules and SSL certificates. For example, if your company has a security team that manages firewalls and SSL certificates and a networking team that manages the rest of the networking resources, then grant the networking teams group the network admin role, and the security team, the security admin role. You can also grant a single entity both permissions. This role is an owner role for a billing account. Use it to manage payment instruments, configure billing exports, view cost information, link and unlink projects, and manage other user roles on the billing account.