What's not supported in Domain Transfer?

Android Enterprise is not supported. To avoid data loss, you need to take the following steps before the transfer:

1. Check for active EMM bindings and remove the devices associated with the bindings. For details, go to Manage EMM bindings.
2. If you developed any private apps, make sure that you secure access for your source environment to the associated Google Play developer account.
3. In your source environment's Google Admin console, delete the EMM bindings. For details, go to Cancellation and data deletion.

Additionally, in the source environment, you should remove any devices with zero-touch enrollment. You can add them in the destination environment after the transfer. For details, go to Zero-touch enrollment.

If you're using a Cameyo subscription, you can't change your primary domain, because the subscription blocks the primary domain change. To proceed with the domain change, you must first remove all Cameyo licenses that are on your current primary domain before swapping it with the new domain.

For details on the impact of removing Cameyo licenses, go to Understand your Cameyo payment plan.

• Make sure the forced re-enrollment policy is off for all organizations and you deprovision all devices.
• The subscription, in addition to all licenses, must be removed before swapping the primary domain with the placeholder domain. If necessary, the subscription can be restored and devices can be re-enrolled against the placeholder domain after the swap.
• To remove Chrome Enterprise licenses, contact ompf-helpdesk@google.com for assistance.

• The subscription, in addition to all licenses, must be removed before swapping the primary domain with the placeholder domain. If necessary, the subscription can be restored and devices can be re-enrolled against the placeholder domain after the swap.
• Learn more about perpetual upgrades.

• Essentials Starter, Essentials, Enterprise Essentials, and Enterprise Essentials Plus are not supported.
• Essentials Starter, Essentials, Enterprise Essentials, and Enterprise Essentials Plus do not support Partial Domain Licensing.
  • You cannot add other Google Workspace or G Suite Business and Basic licenses to a destination environment that's using an Essentials Starter, Essentials, Enterprise Essentials, and Enterprise Essentials Plus license.
  • You cannot add Enterprise Essentials or Essentials licenses to a destination environment that contains other Google Workspace or G Suite Business and Basic licenses.
  • Upgrade from an Essentials Starter, Essentials, Enterprise Essentials, and Enterprise Essentials Plus license to a supported license before a transfer for the transfer to be eligible.

• This Drive storage license must be removed before starting the transfer process.
• If users have Business Starter or G Suite Basic licenses, and a Google Drive storage license is removed:
  • Data is not erased and remains available.
  • Products cannot add extra storage over the storage limit.

  Note: There are specific implications for products like Gmail, Drive, and Google Photos if you run out of space. Learn more

• If users have Enterprise Plus, Enterprise Standard, Business Plus, Business Standard, or G Suite Business licenses, and a Drive storage license is removed, there's no impact to users.
• Learn more about Drive storage licenses.

• Google Meet global dialing is not supported and existing logs don't transfer to the destination environment.
• If required, you can set up Meet global dialing in the destination environment. Learn more

• Voice is not supported and data doesn't transfer from the source environment to the destination environment.
• The Voice license might also be a blocker to the transfer process, regardless of whether the source environment is using it. If it was ever present, the transfer can only continue under the following conditions:
  • All Voice numbers must be unassigned from users either manually or they can potentially be transferred.
  • All Voice licenses must be removed from users.
  • The entire Voice license subscription must be canceled.
  • The customer must agree to the Voice engineering team permanently deleting any Voice data associated in the source environment.
• These conditions are required since if a source environment ever had a Voice license, the future Voice management of transfer users in the destination environment is unavailable. There's currently no workaround.
• This only applies to the Voice license within Google Workspace that allows administrators to manage Voice on behalf of their users. It doesn't apply to an individual user who might have used Voice on their own.

• Administrator roles applied to service accounts are not reassigned to the destination environment.
• After the transfer, if necessary, the service accounts should have their admin roles reassigned manually by the destination environment admins.
• All admin access for service accounts in the source environment is revoked during the transfer process.

• Administrators from the source environment move to the destination environment and become regular users, with their admin roles revoked.
• After the transfer, if necessary, source environment administrators should have their admin roles reassigned manually by the destination environment admins.
• All admin access (for both the source and destination environments) are revoked through role removal during the transfer process.

• Administrator roles applied to security groups are not reassigned to the destination environment.
• After the transfer, if necessary, the transferred security groups should have their admin roles reassigned manually by the destination environment admins.
• All admin access (for both the source and destination environments) for groups is revoked through role removal during the transfer process.

• The configured key service in the source environment will not transfer to the destination environment.
• Domain Transfer can migrate encrypted Google Drive files. However, because the encryption key service does not migrate, any migrated documents cannot be decrypted thus rendering them unreadable.
• As such, having client-side encryption (CSE) turned on in the source environment is a blocker for Domain Transfer. Learn more

Custom directories are not moved and must be regenerated in the destination environment's Google Workspace Directory.

• Applications that use domain-wide delegation must be manually added to the access lists in the destination environment's security settings (client and scopes) to keep their functionality. Learn more
• Important: If an application is impersonating a source environment admin, these admin users don't automatically keep their privileges after the transfer.

• However, the following items are included in the transfer:
  • Custom URL mappings for Google Sites in the Admin console, along with the associated domain, are copied from the source environment to the destination environment.
• Shared drives in the source environment are moved to the transfer root organizational unit of the destination. Administrators in the destination have access to the shared drives, but they might be restricted to others. The transfer process might also cause additional organizational unit-scoped policy restrictions or trust rules to change, but it won't affect the shared drives' Access Control List.

• Custom-made target audiences don't transfer from the source environment to the destination environment.
• If you transfer files that are shared with the default target audience in the source environment, you choose how you want all transferred files to be shared on the target domain. For details, go to Google Drive, Docs, Sheets, Slides, Forms & Drawings in Core applications.
• Target audiences applied to the documents of transferred users remain available, though the target audiences are not visible or modifiable from the destination environment's Google Admin console.
• Transferred users can view the sharing permissions for a target audience, but there's a warning if the target audience is external to the organization.
• Transferred users can modify or delete the sharing permissions. If they're removed, they cannot be added again as the destination environment policies now apply and only destination environment target audiences are available under the sharing options.

Learn more about target audiences.

• Unmanaged accounts are users who independently create a Google Account using one of your organization's domains. For more information, go to Find and add unmanaged users.
• Pending invitations for unmanaged user accounts do not transfer from the source environment to the destination environment.
• When an unmanaged user moves with their domain to another entity, the pending user invitation expires.
• If you click the pending user invitation, you receive the following error message: "Your invitation has expired. The link for verifying is no longer active."

• Dynamic groups transfer, but membership updates are paused until the membership query is updated. For more information, go to Step 3: Destination environment tasks.
• All members at the time of the transfer remain after the transfer, regardless of membership rules.

• Apps Script files will transfer along with other Drive content, but the Google Cloud projects that back them do not. Organization policies continue to govern these projects in the source environment. Learn more
• The recommended workaround is for users to create a copy of their Drive files after the transfer. This action generates new Google Cloud projects governed by organization policies on the destination environment.
• Posttransfer, applications might not function as expected, and users might get OAuth consent screens that need to be accepted to run scripts. Additionally, errors might appear if the destination environment has different policies that limit which scopes can be requested when using Apps Script.

• Direct messages (DMs) transfer, but group DMs do not transfer.
• Spaces and their messages do not transfer.
• Important: While spaces and group DMs remain in the source environment, some data might remain accessible to transfer users if the spaces and Google Groups were set up to allow external members. These spaces and groups are removed once the source environment is deleted. You should instruct users to create spaces and groups in the destination environment, even if the previous ones are still accessible.
• Custom emojis used in Chat don't transfer. After a transfer, users see only the custom emojis of the destination environment. One-on-one DMs that used custom emojis in the source environment show a placeholder value instead.

• If you wish to transfer your Voice numbers to the destination environment, Google can transfer them for you.
• There are some restrictions on whether a Voice number transfer is possible.
  • Source environment:
    • The number is being acquired from another source. This could either be a pending number, or a number that's part of another transfer.
    • Google doesn't manage the number directly.
    • The number is part of a number block. This includes numbers in Switzerland (CH), Italy (IT), and Germany (DE).
  • Destination environment:
    • You might not be allowed to own a number from a certain country/region. This could be due to not having the correct version of Google Voice Enterprise, or not having set up a primary address in the country/region.
    • The transfer would exceed the destination's domain number limits.
• If the transfer can proceed:
  • Google will coordinate a time with you for the transfer process.
  • You don't have to unassign all numbers in advance.
  • You must agree to take all actions required by Google.
  • Once the transfer executes, Voice users in the source environment cannot receive calls at their number until the Domain Transfer is complete and the numbers are reassigned.

For more information, go to Google Voice under Source licenses.

• Google Workspace Domain Transfer will not transfer alpha and beta program enrollments.
• If there are specific programs either the source or destination environment is enrolled in that the other environment is not, the unenrolled environment needs to apply to and be accepted into those programs.
• If the destination is enrolled in domain-specific programs, any new source domains need to be admitted.
• It's recommended enrollment is done pre-transfer so the experience and available features for transfer users is the same throughout the transfer process.

Important

• Google Cloud organization—When transferred, users and groups become external to the Google Cloud organization associated with the source environment or placeholder domain.
• OAuth clients—If you have OAuth clients that are configured as internal applications (including clients used for authentication with an Identity-Aware Proxy), users can't authenticate after a transfer because they are external to the associated Google Cloud organization. Before the transfer, you should evaluate whether to make the clients external or add the users as testers and not publish externally.

Impacts

• Google Cloud projects remain in the organization associated with the source environment.
• The organization node name changes to the placeholder domain after the primary domain swap occurs. It might take several days to update.
• The source environment can be maintained for the administration of the associated Google Cloud organization. However, the Domain Transfer process makes the source environment unsuitable for Google Workspace production use.
• Identity & Access Management (IAM) permissions for users and Google Groups are not affected.
• Google Cloud projects attached to Apps Script files remain in the source environment.

Watchpoints

The following items should be evaluated and adjusted to ensure continuity once the transfer is complete:

• Project permissions scoped to a specific domain (governed by an IAM policy defined by a domain prefix).
• Project IAM bindings with the basic owner role can only have a Google group assigned as the owner role for projects if they are both in the same organization. Users can only be assigned the owner role interactively.
• Source organizations that restrict identities by domain. Note that this doesn't impact existing users, only future ones.
• IAM permissions that don't provide instance access for external users.
• Terraform configurations and custom automation code that statically reference domain names and organization IDs (for example, project vending automation).
• Custom automation code manages entities that are being transferred (for example, managing membership of certain groups via Terraform).

Google Cloud migration

• Migration of Google Cloud projects might be a complex process, depending on the nature of the projects. If a migration is required, it can happen before or after the transfer process. However, we do not recommend coupling the 2 projects together.

  Your Google Cloud contact can connect you with a team at Google that manages Google Cloud project migration.

• Policies and configurations do not transfer. Destination environment policies govern transfer users after the transfer.
• If the source environment is using advanced mobile management for Android devices, the environment is ineligible and the transfer process cannot proceed. Under certain circumstances, some users might experience uninstallation of all non-system applications when transferred from a source environment with advanced mobile management for Android devices.
• Learn more about Google endpoint management.

• Chromebooks and Meet hardware devices enrolled in the source environment do not transfer. Remove the units from the source environment and reprovision in the destination environment. Learn more about Chrome devices and Meet hardware.
• There are additional licensing considerations. For details, go to the Google Meet hardware sections in Source licenses.
• Chrome zero-touch enrolled devices don't transfer. For information on how to proceed, go to the Chrome zero-touch enrolled devices section in Step 1: Source tasks.

Looker Studio—Report or data source sharing permissions. For details, go to Step 3: Destination environment tasks.

• Services keyed to the user might continue to work as expected. For example, with YouTube the user controls all ownership and verification, not the organization.
• The following services were involved in previous transfers. While no major issues were reported, past behavior isn't indicative of present and future behavior:
  • Campaign Manager
  • Display & Video 360
  • Google Ads
  • Google Analytics
  • Google Play (store and ecosystem)
  • Search Ads 360
  • YouTube

• Domain-wide installed apps in the source environment do not transfer.
• Domain-private apps in the source environment are not supported. Transfer users lose access to those apps after the transfer.
• Domain-wide installed apps in the destination environment are automatically available to transfer users after the transfer.

• EMMs used to secure corporate data on employee mobile devices are not supported.
• This includes technologies such as:
  • BlackBerry EMM
  • Citrix XenMobile
  • IBM MaaS360
  • Microsoft Enterprise Mobility + Security
  • MobileIron
  • VMware AirWatch

• Most are likely keyed to the user and might continue to work as expected.
• If there's a third-party service especially important for you, check if the service has any dependencies on IDs, organizational units, or domain names.