Link a Data Studio Pro monthly active user subscription to a Google Cloud project

Intended audience: This document is intended for Cloud Identity or Google Workspace administrators whose organization has a Data Studio Pro subscription that was set up for them by Google Sales or a Google reseller partner with Monthly Active User pricing. If your organization is not already using Data Studio Pro, or if your subscription was set up using the self-service, division-based pricing model, this document doesn't apply to you. Learn more about the Data Studio Pro self-service upgrade process.

In Data Studio, individual users own the assets (reports, data sources, and explorations) that they create or that have been transferred to them. To keep Data Studio assets working after their owner leaves an organization, an administrator must transfer those assets to another user. Otherwise, those assets will likely be deleted and the departing user's data credentials will be revoked, breaking that user's reports and data sources.

Data Studio Pro assets, on the other hand, are organized hierarchically, with your Cloud Identity or Google Workspace organization as the ultimate owner. Organizational ownership ensures that your Data Studio assets continue to work even if their individual owner leaves the organization.

Specifically, organizational ownership offers the following benefits:

• All the Data Studio assets that your users create are stored in a Google Cloud project that you control and manage.
• Data Studio Pro assets are protected from deletion should their creator leave your organization.
• You can use IAM to assign project-level permissions that apply to all Data Studio Pro assets in your organization.
• Data Studio Pro assets are available to other Cloud services (for example, data lineage in Knowledge Catalog).

Use Data Studio Pro in your organization

To use Data Studio Pro in your organization, you'll need to link Data Studio Pro to a Google Cloud project. Optionally, you can add principals on the project to manage Data Studio assets.

Link to a Google Cloud project

To complete this step, you'll provide a Google Cloud project which you'll use to manage Data Studio assets. This project will also be used to bill your organization for your Data Studio Pro subscription.

Cloud project requirements

Choose your Google Cloud project carefully! Once Data Studio is linked to your project, you can't move your Data Studio assets to another project. We recommend using a project dedicated to Data Studio.

• The project that you choose must use the same billing account that your organization uses for your Data Studio subscription.
• When you set up organizational ownership of Data Studio Pro assets, Google Cloud automatically creates a lien on the project to prevent accidental deletion of those assets. Be sure you have the resourcemanager.projects.updateLiens permission, which is granted by the roles/owner and roles/resourcemanager.lienModifier roles, so that Google Cloud can create the lien for you.
• The user who performs the upgrade to Data Studio Pro must must have the Workspace Services Admin role, or a another role that grants them the Manage Data Studio Settings privilege in the organization that owns the project.
• The user who performs the upgrade to Data Studio Pro must also have the owner role for the project.

For resellers: The resold customers will need to provide a project that is linked to the billing account of the reseller subscription.

See the best practices section for additional tips before proceeding.

Steps

1. Sign in with an administrator account to the Google Admin console.

   Note: If you aren't using an administrator account, you can't access the Admin console.

2. In the Google Cloud console, go to Billing and then select My Projects.

3. Locate the project that you want to use for Data Studio asset management and billing and make a note of its project ID.

4. Sign in to Data Studio.

5. In the left navigation, click Enterprise Admin.

6. In the settings dialog that appears, on the left, click Project ownership.

7. In the Project ID field, enter your Google Cloud project ID.

Optional: Add principals to the project

Individual Data Studio users DO NOT need to be added to the project. However, if you want to allow others in your organization to manage the Data Studio project, you can add principals to that project using the IAM resource manager in the Google Cloud console. See the best practices section for advice.

You can grant principals the following IAM roles:

Role	Description
Data Studio Admin ( roles/datastudio.admin )	Includes all permissions to reports and data sources.
Data Studio Asset Viewer ( roles/datastudio.viewer )	Includes view permissions to reports and data sources.
Data Studio Asset Editor ( roles/datastudio.editor )	Includes edit permissions to reports and data sources. Does not include delete permissions.

Keep the following information in mind while granting roles to principals:

• Currently, these roles use the Data Studio name.
• Data Studio does not support custom roles.
• To see the individual IAM permissions that each role includes, see the IAM permissions reference.

Best practices

We recommend the following best practices when you're setting up your Data Studio Pro project:

Create a separate Google Cloud project for your Data Studio Pro assets

It's a good idea to create a dedicated project to manage Data Studio Pro assets. Keeping this project separate from your other projects helps make it clear what the project is used for and helps prevent accidental deletion of your assets.

Limit the number of principals on the project

Keep the number of people you add to the project to a minimum. Remember, access to the project is NOT a requirement to use Data Studio. Instead, think about Data Studio project access as a way to delegate administrative functions to a select few individuals.

Follow the principle of least privilege

If you add people to the project, grant them the minimum role that is required to manage your Data Studio assets according to your organization's policies.

Use the roles that are specific to Data Studio. Don't use IAM basic roles. Basic roles include thousands of permissions across all Google Cloud services. In production environments, don't grant basic roles unless there is no alternative. Instead, grant the most limited predefined roles that meet your needs.

Learn more about how to use IAM securely.

Organization changes

If you've linked Data Studio Pro to a project in one organization and later want to transfer that project to a different organization, do the following:

1. Sign in with an administrator account to the Google Admin console.

   Note: If you aren't using an administrator account, you can't access the Admin console.

2. Complete the setup of the new organization in Google Cloud console.

3. Migrate the original project, users, and resources from the old organization to the new organization. Learn more about migrating projects.

4. Sign in to Data Studio.

5. In the left navigation, click Enterprise Admin.

6. In the settings dialog that appears, on the left, click Project ownership.

7. In the Project ID field, enter your Google Cloud project ID.

   Important: This MUST be the same project that was used by the old organization.

8. Click Link project.

For other transfer scenarios, please contact Cloud Customer Care for assistance.

Limits of Google Cloud project linking

• You can link Data Studio to only one project.
• Once Data Studio is linked to your project, you can't link it to another project.
• Because Data Studio Pro projects have a Google Cloud lien placed on them, your assets are protected from accidental deletion. If you delete a project, all Data Studio Pro assets in that project are marked for deletion. If you restore the project within 30 days, your Data Studio Pro assets will be recovered automatically. Restoration may take some time but requires no manual intervention.