[Product Update] New security enhancement for your Google Cloud environment

Hello Alejandro,

We're reaching out with an important update regarding enhancing the security of sensitive actions in your Google Cloud environment. This update strengthens protection against unauthorized access to your critical Google Cloud resources.

We have provided additional information below to guide you through this change.

What you need to know

Key changes

Starting in July 2025, to further protect your critical Google Cloud resources, you will need to re-enter your password or complete multi-factor authentication (MFA) for certain sensitive actions. These actions include billing assignment changes and IAM policy changes at the Organization, Folder, or Project level.

This additional authentication step ensures that only authorized users can make critical changes to billing and access control settings.

Re-authentication limitations

This re-authentication will initially apply to Google Cloud Console users with Google Cloud Identity. It will not apply to programmatic user account access or external identities federated through Workforce Identity pools and SSO.

Actions that require re-authentication

Specifically, you will be prompted to re-authenticate when performing the following actions (which correspond to these API calls):

• resourcemanager.organizations.setIamPolicy
• resourcemanager.folders.setIamPolicy
• resourcemanager.projects.setIamPolicy
• billing.accounts.setIamPolicy
• billing.accounts.move
• billing.accounts.removeFromOrganization
• billing.resourceAssociations.create
• billing.resourceAssociations.delete
• resourcemanager.projects.deleteBillingAssignment
• resourcemanager.projects.createBillingAssignment
• resourcemanager.tagValueBindings.delete

Note: Service accounts are not affected by these new re-authentication requirements.

What you need to do

No action is required from you. This enhanced security will be automatically applied starting July 2025.

We're here to help

You can find more details about Reauthentication for Sensitive Actions in our User Guide. If you have any questions or require assistance, please contact reauth-for-sensitive-actions@google.com.

Thank you for your understanding and cooperation as we work to improve security in Google Cloud.

Thanks for choosing Google Cloud.