Control of MCP use with organization policies is deprecated. After March 17, 2026, organization policies that use the gcp.managed.allowedMCPServices constraint won't work, and you can control MCP use with IAM deny policies. For more information about controlling MCP use, see Control MCP use with IAM.
After March 17, 2026, when you enable Resource Manager, the Resource Manager MCP server is automatically enabled.
]]>Access Resource Manager using our remote MCP server
You can use the Resource Manager remote MCP server to search for and identify all Google Cloud projects you have permission to access, so you have the correct identifiers before configuring specific resources.
The Resource Manager remote MCP server is in Preview.
]]>The list of Organization Policy Service constraints that are enforced when an organization resource is created has changed. The following Google Cloud security baseline constraints are enforced for all organizations created on or after May 3, 2024:
constraints/iam.managed.disableServiceAccountKeyCreationconstraints/iam.managed.disableServiceAccountKeyUploadconstraints/iam.automaticIamGrantsForDefaultServiceAccountsconstraints/iam.allowedPolicyMemberDomainsconstraints/essentialcontacts.managed.allowedContactDomainsconstraints/compute.managed.restrictProtocolForwardingCreationForTypesconstraints/storage.uniformBucketLevelAccessFor more information, see Manage baseline constraints.
]]>Designate project environments with tags: You can now use tags to visually distinguish projects based on their environment—such as production, staging, or development—directly within the Google Cloud console. This new visual indicator helps prevent errors and improves awareness when you're working in sensitive environments. For information, see Designate project environments with tags.
]]>Custom organization policies are now available in Preview for Cloud Resource Manager. For more information, see Manage resources with custom constraints.
]]>Custom organization policies are now generally available for Essential Contacts. For more information, see Creating custom constraints for Essential Contacts.
]]>Cloud Data Fusion supports annotating resources with tags in Preview. For more information, see the Services that support tags.
]]>You can add tags at the time of creating folders and projects. These tags can be added as key-value pairs. For more information, see Add tags during folder creation and Add tags during project creation. This feature is currently in preview.
]]>With the secure-by-default organization policy enforcements, insecure posture is addressed with a bundle of organization policies that are enforced at the time of creation of an organization resource. Enforcement of these policies will apply to organizations created early in 2024, as the feature is gradually rolled out.
]]>Tag key and value short names can now have a maximum length of 256 characters. For more information, see Tags overview.
]]>You can now create tags that are children of projects as well as organization resources. For more information, see Creating and managing tags.
]]>The organization restrictions feature has entered General Availability. The organization restrictions feature helps security administrators to prevent data exfiltration due to phishing or insider attacks. The organization restrictions feature restricts access only to resources in authorized Google Cloud organizations. For more information, see Introduction to organization restrictions.
]]>The feature for listing all tags that are attached to or inherited by your resources has entered general availability. For more information, see Creating and managing tags.
You can now use the Cloud Console UI to create and manage tags. For more information, see Creating and managing tags.
]]>The organization restrictions feature has launched into public preview. The organization restrictions feature enables you to prevent data exfiltration through phishing or insider attacks. For managed devices in an organization, the organization restrictions feature restricts access only to resources in authorized Google Cloud organizations. For more information, see Introduction to organization restrictions.
]]>A feature for protecting tag values from being deleted has launched into general availability. If a tag value has a tag hold, it cannot be deleted by users unless the tag hold is first deleted. For more information about tag holds, see Protecting tag values with tag holds.
]]>The feature for listing the effectively evaluated tags on a resource has launched into public preview. For more information, see Listing effective tags on a resource.
]]>The Resource Settings API has entered general availability. You can use Resource Settings to centrally configure settings for your Google Cloud projects, folders, and organization. For more information, see Resource Settings overview.
]]>The process for migrating a project from one organization to another has released into general availability. To make it easier to see the impact a project migration will have on your organization, you can use the Cloud Asset Inventory Analyze Move API to get a detailed report before performing a move. For more information, see Migrating projects and Analyze project move.
]]>The Resource Manager v3 API has been released into general availability. For more information, see the API reference documentation.
]]>The Resource Manager v3 API has been released into public preview. For more information, see the API reference documentation.
]]>Tags have been launched into general availability. For more information, see the Tags overview.
]]>Project migration between organizations is now a self-serve process in public preview. For more information, see Migrating projects.
]]>If you run one of the gcloud tool's add-iam-policy-binding commands, and the IAM policy contains conditional role bindings for that role, the gcloud tool prompts you to choose one of the condition expressions that exists in the policy. If you choose a condition expression that contains a comma, the command fails.
To work around this issue, use the --condition flag to specify a condition expression on the command line.
Tags have released into public preview. Tags provide a way to conditionally allow or deny policies based on whether a resource has a specific tag. You can use tags and conditional enforcement of policies for fine-grained control across your resource hierarchy. For more information, see the Tags overview.
]]>You can now customize who receives notifications from Google Cloud with Essential Contacts. This feature is available in preview. For more information, see Managing contacts for notifications.
]]>Organization setup wizard beta release
The organization setup wizard UI makes it easier for you to delegate setup and management of Organization resources to other users, assign fundamental IAM roles to users, and import existing projects and billing accounts to your organization.
]]>Audit Logging for ContactInfo Beta Release
Audit Logging support has been expanded to support the European Union General Data Protection Regulation (GDPR). The UpdateContactInfo and GetContactInfo operations have been added to the list of audited operations.
Folders General Availability
Cloud folders are nodes in the Cloud Platform Resource Hierarchy. A folder can contain projects, other folders, or a combination of both. You can use folders to group projects under an organization in a hierarchy. For example, you organization might contain multiple departments, each with its own set of Cloud Platform resources. Folders allows you to group these resources on a per-department basis. Folders are used to group resources that share common IAM policies.
]]>Organization Resource Automatic Provisioning
With this launch we made the Organization resource automatically available to all Google Workspace and Cloud Identity customers. Google Workspace customers just need to create a project using their domain email account and the Organization resource will be automatically provisioned for them.
]]>