Skip to main content

Moving Organizations Within The Hierarchy

You can move an existing branch of an organization containing other dependent organizations and applications to a new branch or level in the hierarchy. This feature is also useful to transform your organization's existing single-level hierarchy into an N-level hierarchy model.

All organization-level configurations like policies, application categories, labels, license threat groups, and waivers remain unaffected by the change and will still apply to all applications and other organizations under it, as before.

157681247.png

In the example above, on the completion of the move, all previously configured policies, application categories, license threat levels, and waivers for Organization A will continue to apply to applications App A.1, App A.2, etc. In addition, Organization A will also inherit the organization-level configurations of Organization B which is the new parent. We recommend reviewing all inherited configurations to ensure correct enforcement and remediations.

Steps to Move an Organization to a New Parent

1. Click on the Tree View button to view the graphical representation of your organization hierarchy.

2. Locate the existing organization using the filter on the Inheritance Hierarchy page and click on the organization name from the search results.

157681072.png

3. Click on the Actions menu and choose Move Organization.

157681073.png

4. Choose the name of the new parent organization, under which you want to move your current organization.

157681316.png

5. Click Move to complete the "Move" operation.

157681311.png

Error Messages

You may encounter error messages during a "Move" operation.

157681318.png

Click on the Download CSV button to review the conflicts. You can retry the "move" after fixing these conflicts.

The conflicts occur due to conflicts between the inherited configuration attributes of the old parent organization and the new parent organization. These attributes are:

  1. Application Categories

  2. Labels

  3. License threat groups

  4. Policies

There are two possibilities for conflicts in configuration settings to occur:

  • Missing configuration attributes in the new hierarchy

  • Duplicate configuration attributes in the new hierarchy

Missing configuration attributes in the new hierarchy

Consider an organization in the hierarchy, where it is inheriting configuration attributes from another parent organization (at a higher level.) When this organization is moved under a different parent organization in a different branch in the hierarchy, the older inherited attributes will no longer be available. These missing configuration attributes will cause a conflict during the move operation.

Duplicate configuration attributes in the new hierarchy

Consider an organization with named configuration attributes set up to be inherited by organizations and applications under it. When this organization is moved under a different parent organization that has the same name configuration attributes that are inheritable, it will encounter duplicate configuration attributes. These duplicate configuration attributes will cause a conflict during the move operation.

Steps to fix the conflicts:

  1. Identify or create a new organization in the hierarchy at a level such that it is set up as a parent to both, the source and destination organization.

  2. Assign all the conflicting configuration attributes of the source and destination organization to the common parent.

This will allow the same set of attributes to be inherited by source and destination organizations.

Retry the "move" operation to complete the process.

Warnings

You may encounter warnings during a "Move" operation. Warnings mean that the move operation was successful, but needs additional review to verify that the enforcments are set up correctly.

Examples of warning messages

Example 1:

157681414.png

Example 2:

157681773.png

The warning message will indicate the conflicts that the "Move" operation encounters. Some of them include:

  1. Inherited license overrides

  2. Inherited waivers

  3. Inherited continuous policy monitoring settings (e.g. continuous policy monitoring is not being inherited from the new parent, stages involved in continuous policy monitoring are not the same as what was inherited from the old parent)

Steps to resolve the warnings:

  1. If the warning indicates conflicts between old inherited license overrides and new inherited license overrides, reassign the license overrides at the new parent level (destination organization).

  2. If the warning indicates conflicts between old inherited waivers and new inherited waivers, review the waivers and reassign them at the new parent level (destination organization).

  3. If the warning indicates conflicts due to continuous policy monitoring, adjust the settings at the new parent level (destination organization) such that it is inherited by the moved organization.