Skip to main content

 

Cisco Meraki Documentation

Network Move Overview and FAQ

  1. Last updated
  2. Save as PDF

Overview

Network portability lets you move a network from one organization to another while keeping the network configuration and devices together. Use it when you need to reorganize networks across organizations without rebuilding the network from scratch.

Network move can be used with appliance, camera, switch, wireless, and combined networks.

You can move networks using either the Cisco Managed Automation Workflow in Dashboard or the Network Move API. Both methods run the same validation and move process.

Network moves run in the background. Most complete in less than 20 minutes after processing starts, although timing depends on the number of devices in the network and the number of moves already queued.

After a successful move, Dashboard logs the action in the Organization Change Log (Organization > Monitor > Change Log) for both the source and destination organizations.

To ensure that Dashboard services responsive for all users, network moves may not start immediately.

If you create multiple network moves through the API, the moves will run sequentially in the order received.

Can my network be moved?

Use this section to check the most common requirements before attempting a network move. If any item does not apply to your network, review How to prepare your network for moving before starting the move.

Basic requirements

  • You have full organization admin rights in both the source and destination organizations.
  • The source and destination organizations use the same regional Dashboard domain: meraki.com, meraki.cn, meraki.ca, or meraki.in. For a move between shards in the same region, enable Network Move API under Organization > Early Access in the source organization.
  • The network is not a template and is not bound to a template.
  • All subscription licenses are unbound from the network.
  • Site-to-site VPN and Auto VPN are disabled.
  • SSID tunneling, also known as Layer 3 roaming, is disabled.
  • The network is not assigned to a network group.
  • No firmware upgrades are pending for devices in the network.

If these requirements are met, continue to Network configuration restrictions and review the restrictions for the products in your network.

If one or more requirements are not met, resolve those issues before moving the network.

Network move workflow

Most network moves follow five stages: assess, prepare, execute, monitor, and validate.

Network move workflow showing five stages: assess, prepare, execute, monitor, and validate.

Prerequisites

Administrative and organization requirements

  • The Dashboard or API user must have full organization admin rights in both the source and destination organizations.
  • The source and destination organizations must use the same regional Dashboard domain. If they are on different shards within that region, enable Network Move API under Organization > Early Access in the source organization.
  • The network must not be assigned to a network group.
  • No firmware upgrades can be pending for devices in the network.

Configuration requirements

Network configuration restrictions

Some configurations prevent network moves. The sections below separate permanent blockers from settings that can be changed before moving the network.

Permanent blockers: Networks with any of these conditions cannot be moved:

  • Systems Manager (SM) networks
  • Template networks or networks bound to templates
  • Networks that have organization-wide group policy settings
  • Networks with no devices
  • Wireless networks that have ever used billing on any configured SSID. To check, go to Wireless > Configure > Billing. If the billing payout page exists for the network, the network cannot be moved.
  • Networks containing Axis camera devices
  • Networks with billing or payout history
  • Organizations with mismatched NAT Exceptions with Manual Inbound Firewall settings between source and destination

Configuration blockers

The settings below can block a move, but you may be able to resolve them before trying again. See How to prepare your network for moving for common remediation steps.

Product-specific restrictions

Check the restrictions for each product type in your network.

Product Blocking setting What this means Where to check in Dashboard
MX
(Security Appliance)		 Organization-wide policy objects Firewall rules reference policy objects or groups defined at the organization level. Organization > Policy objects
BGP configuration Border Gateway Protocol routing is enabled. Security & SD-WAN > SD-WAN & Traffic Shaping > BGP
XDR integration Extended Detection and Response is enabled at the organization level. Organization > Configure > Settings
Cisco Umbrella integration Umbrella is configured at the organization level, on SSIDs, or in group policies. Organization > Configure > Integrations
Organization-wide VRFs Virtual Routing and Forwarding is used for Auto VPN or SD-WAN configurations. Organization > SD-WAN & Traffic Shaping > VRFs
Custom IPS policy The network is assigned a custom intrusion policy from the source organization. Security & SD-WAN > Threat Protection
Secure Access or SSE The network is enrolled in an organization-level Secure Access or Security Service Edge integration. Organization > Configure > Integrations > Cisco Secure Access
Trusted traffic exclusions The network receives trusted traffic exclusions through its effective security profile. Security & SD-WAN > Threat Protection > Trusted Traffic Exclusions
MR
(Wireless)		 External VPN concentrators SSIDs use Layer 3 roaming to VPN concentrators in other networks. Wireless > Configure > Access control. Check for "VPN" or "Concentrator".
Organization-wide RADIUS servers SSIDs reference RADIUS servers defined at the organization level. Organization > Configure > RADIUS
RadSec with organization CA SSIDs use RadSec with an organization-level CA certificate. Organization > Configure > RADIUS. Check for RadSec configurations.
MS
(Switch)		 Organization-wide VRFs VRFs are used for Layer 3 interfaces, static routes, OSPF, or switch fabrics such as EVPN/VXLAN. Organization > Configure > VRFs
Organization-wide RADIUS servers Access policies reference RADIUS servers defined at the organization level. Organization > Configure > RADIUS
BGP configuration Border Gateway Protocol routing is enabled on switches. Switch > Routing & DHCP > BGP
Switch fabric The network is linked to a switch fabric. Organization > Fabric
Organization-wide SmartPorts The network uses organization-wide port profiles or port-profile automations. Organization > Configure > SmartPorts > Profiles or Automations
MV
(Camera)		 Active video access authorization Customer authorization for video access is active. Cameras > Monitor. Check for active authorizations.
Axis camera devices The network contains Axis-branded camera devices. Cameras > Monitor. Check device models.
All products Monitor-only devices Devices are configured in device-managed mode, also called monitor-only mode. Organization > Inventory. Check device management mode.
ECO admin tags Devices have admin tags that match organization-level Extra Config Options. Organization > Inventory. Check device tags.
Dashboard banners or messages Active organization-level dashboard messages or banners target the network. Organization > Alerts
Trusted certificate dependencies An SSID or encrypted syslog configuration references a trusted certificate in the source organization. Organization > Configure > Certificates
IdP integration The network uses an identity provider resource from the source organization. Organization > Monitor > Users
MG
(Cellular Gateway)		 eSIM-managed devices The network contains devices managed through an eSIM service. Organization > SIM Cards > Inventory

Network moves do not move organization-level features such as administrators, licensing, or policies. If you also need organization-level settings, use Clone Networks and Organizations in Dashboard.

Licensing restrictions

Only the license combinations below are currently supported. Cisco is working to add more license move options.

A network that uses Smart Account or Virtual Account licensing cannot move while that configuration is attached. Remove the source-organization licensing configuration before the move. After the move, configure licensing again in the destination organization.

Same shard To Co-Term To PDL To Subscription
From Co-Term Supported Not currently supported Supported
From PDL Not currently supported Remove the license from devices before moving. Supported
From Subscription Not currently supported Not currently supported Unbind the network from the subscription before moving.

Last updated September 1, 2026.

How to prepare your network for moving

If your network has configuration blockers, use the relevant steps below before attempting the move.

Network Portability does not restore configuration that you remove or disable before a move. Record the current settings, complete the move, and configure the feature again in the destination organization.

Disable site-to-site VPN or Auto VPN

  1. Go to Security & SD-WAN > Site-to-site VPN.
  2. Document the current VPN settings, peer configurations, and routes.
  3. Change VPN mode to None or Off.
  4. Save changes and wait 2-3 minutes for the configuration to propagate.
  5. Proceed with the network move.
  6. After the move, reconfigure VPN as a third-party VPN peer if the network still needs connectivity to the original organization. See VPN reconfiguration in the FAQ.

Disable SSID tunneling (Layer 3 roaming)

  1. Go to Wireless > Configure > Access control.
  2. For each SSID using tunneling:
    • Document the current concentrator configuration.
    • Change the Concentrator setting to None or Local LAN.
  3. Save changes.
  4. Proceed with the network move.

Remove organization-wide policy object references

  1. Go to Security & SD-WAN > Firewall.
  2. Review firewall rules and identify any rules that use organization-wide policy objects or groups.
  3. Replace those policy object references with explicit IP addresses, CIDR ranges, domains, or ports.
  4. Save changes.
  5. Proceed with the network move.
  6. After the move, recreate equivalent policy objects in the destination organization if needed, then update the rules to use them.

Unbind subscriptions, if applicable

  1. Go to Organization > Licenses.
  2. Locate the network in the subscription view.
  3. Select Unbind network from subscription.
  4. Confirm the action.
  5. Proceed with the network move.
  6. After the move, bind the network to a subscription in the destination organization.

Remove network group assignment

  1. Go to Organization > Network groups.
  2. Locate the network group that contains the network.
  3. Select the network and choose Remove from group.
  4. Confirm the action.
  5. Proceed with the network move.

Resolve organization-wide RADIUS servers

  1. Go to Organization > Configure > RADIUS.
  2. Document the RADIUS server configurations, including hostnames, ports, and secrets.
  3. If you want to keep using organization-wide RADIUS servers, create equivalent organization-wide RADIUS servers in the destination organization before the move.
  4. If you do not want to depend on organization-wide RADIUS servers, reconfigure SSIDs or access policies to use network-specific RADIUS servers.
  5. Proceed with the network move.

RadSec organization CA: RadSec is separate from the trusted-certificate validation. If you plan to restore RadSec after the move, create the destination organization's RadSec CA before the move to reduce downtime. After the move, verify or reconfigure RadSec with the destination CA. Creating that CA does not clear an SSID or encrypted-syslog reference to a trusted certificate in the source organization. See MR RadSec - Create the organization CA.

Remove trusted certificate dependencies

  1. Go to Organization > Configure > Certificates.
  2. Find SSIDs and encrypted syslog settings that reference trusted certificates from the source organization.
  3. Record the certificate assignments, then detach those references.
  4. Move the network.
  5. Import or recreate the certificates in the destination organization and attach the SSID and syslog settings to the new certificate records.

Remove organization-level IdP dependencies

  1. Go to Organization > Monitor > Users.
  2. Record the IdP settings and remove the network's dependency on the source IdP resource.
  3. Disable/change any setting using Meraki Authentication (SSID authentication, Client VPN, AnyConnect VPN).
  4. Move the network.
  5. Recreate the integration in the destination organization or attach the network to an existing destination IdP resource.

Remove custom IPS policy assignment

  1. Go to Security & SD-WAN > Threat Protection.
  2. Record the assigned custom IPS policy and select a standard policy.
  3. Move the network.
  4. Recreate the policy in the destination organization or select an equivalent destination policy, then assign it to the network. No further action is needed if the default IPS policy meets your requirements.

 

Remove switch fabric membership

  1. Go to Organization > Fabric.
  2. Record the fabric configuration and remove the network from the fabric.
  3. Move the network, then configure fabric membership in the destination organization if needed.

Remove organization-wide SmartPorts dependencies

  1. Go to Organization > Configure > SmartPorts.
  2. Record and remove organization-wide profiles or automations used by the network. Network-local profiles may remain in place.
  3. Move the network.
  4. Recreate the profiles and automations in the destination organization, or select existing destination resources, then apply them to the network.

Disable Secure Access or SSE

  1. Go to Organization > Configure > Integrations > Cisco Secure Access.
  2. Record the current settings and remove the network from the source organization's Secure Access or SSE setup.
  3. Move the network.
  4. Enroll or enable the network in the destination organization's SSE setup.

Remove trusted traffic exclusions

  1. Go to Security & SD-WAN > Threat Protection > Trusted Traffic Exclusions.
  2. Record and remove the exclusions applied through the network's effective security profile.
  3. Move the network, then recreate the exclusions in the destination organization if needed.

Remove eSIM-managed devices

  1. Go to Organization > SIM Cards > Inventory.
  2. Identify the eSIM-managed devices in the network and remove them before the move.
  3. Move the network, then add and configure the devices in the destination organization.

Remove Smart Account or Virtual Account licensing

  1. Go to Network-wide > Management Mode.
  2. Record and remove the source organization's Smart Account or Virtual Account configuration.
  3. Move the network, then configure the destination organization's licensing association.

Use simulate mode to test

Before executing an actual move, you can test the request with simulate mode.

  1. Call the Create Network Move API with "simulate": true.
  2. The API runs validation checks without moving the network.
  3. Review any returned errors to identify blocking configurations.
  4. Resolve the reported issues.
  5. Run simulate mode again to confirm that the blockers are resolved.
  6. Execute the actual move with "simulate": false, or omit the parameter.

New validation errors

Simulate mode may return one or more of the errors below. The API and Cisco Managed Automation Workflow use the same validation.

Error message What to do
Cannot move network: This network uses Smart Account / Virtual Account licensing configuration that is not preserved by Network Portability today. Please remove the configuration before moving the network, then recreate it after the move. Remove the source licensing association. Configure licensing again in the destination organization after the move.
Cannot move network: This network references organization-level trusted certificates that are not preserved by Network Portability. Please remove the trusted certificate dependencies before moving the network, then recreate them after the move. Detach trusted certificates from SSIDs and encrypted syslog settings. Import or recreate the certificates in the destination organization and attach the settings to the destination certificate records.
Cannot move network: This network uses IdP integrations that are not preserved by Network Portability today. Remove the IdP-related configuration before moving the network, then recreate it after the move. Remove the source IdP dependency. Recreate the integration or use an existing IdP resource in the destination organization.
Cannot move network: Network is assigned a custom IPS policy. Remove or reassign the custom IPS policy before performing the network move. Assign a standard IPS policy before the move. Recreate or select an equivalent custom policy in the destination organization afterward if needed.
Cannot move network: Networks linked to a switch fabric are not supported for network moves. Please remove the switch fabric configuration before retrying the move. Remove the network from the fabric before the move. Configure fabric membership again in the destination organization if needed.
Cannot move network: This network depends on organization-wide port profiles or port-profile automations. Please remove those dependencies before the move. Remove organization-wide SmartPorts dependencies. Recreate or select destination profiles and automations, then apply them after the move.
Cannot move network: This network participates in Secure Access / SSE, which Network Portability does not preserve today. Please disable the Secure Access / SSE-related configuration before running the network move, then enable it again after the move. Remove the network from the source SSE setup. Enroll or enable it in the destination organization's SSE setup after the move.
Cannot move network: This network has trusted traffic exclusions applied through its effective security profile. Please remove the trusted traffic exclusions before moving the network, then recreate them after the move. Remove the exclusions before the move and recreate them in the destination organization afterward if needed.
Cannot move network: Networks with eSIM-managed devices are not supported by Network Portability today. Please remove eSIM-managed devices from the network before performing the move. Remove the eSIM-managed devices, move the network, then add and configure the devices in the destination organization.

Workflow failed due to destination organization retrieval error.

Create/use a valid target that exists in both source and destination Organizations.

Moving a network

After the prerequisites are complete, you can move networks between organizations in the same Dashboard region. For a cross-shard move, first enable Network Move API under Organization > Early Access in the source organization.

  • Cisco Managed Automation Workflow: Dashboard-based workflow, best for one-off moves and users who do not need scripting.
  • Network Move API: Programmatic method for automation, scripting, and bulk operations.

Both methods use the same validation and move process.

Method 1: Cisco Managed Automation Workflow

The Cisco Managed Automation Workflow provides a guided Dashboard experience for moving a network to another organization.

You must first create an Automation target (Automations > Targets) using an API key that is from an Org Administrator account on both the source and destination organizations. Using the default "Meraki - Current Org" target will result in an error "Workflow failed due to destination organization retrieval error".

ccess the automation workflow

  1. Log in to the Meraki Dashboard.
  2. Go to Organization > Automation > Exchange.
  3. Find the workflow named Move Network to Another Organization.
  4. Open the workflow tile.
  5. Click Run Workflow.

Configure the workflow

The workflow asks for these inputs:

Parameter Description Required
Source Organization The organization that currently contains the network. Yes
Network to Move The network within the source organization. Yes
Destination Organization The organization where the network should be moved. Yes
Simulate Mode Validates the move without executing it. No

Run the workflow

  1. Select the source organization, network, and destination organization from the dropdown menus.
  2. Enable simulate mode first if you want to validate prerequisites without moving the network.
  3. Review the selected inputs.
  4. Click Run.
  5. Monitor the workflow as it validates prerequisites, checks for configuration blockers, queues the move, monitors progress, and reports the final status.

Benefits of the Automation Workflow

  • It walks you through the required inputs.
  • It checks prerequisites before attempting the move.
  • It shows progress and status updates while the move runs.
  • It returns clear error messages when a prerequisite is not met.
  • It does not require API or scripting knowledge.
  • It records the workflow run in Automation logs.

Workflow execution logs

After running the workflow, you can review execution details.

  1. Go to Organization > Automation > Executions.
  2. Locate the Move Network to Another Organization workflow run.
  3. Open the run to view validation results, the move ID, errors or warnings, and the completion timestamp.

Method 2: Network Move API

Use the Network Move API when you need to script moves, integrate them into another system, or manage moves at scale.

API workflow

  • Start a network move by calling the Create Network Move API. The API queues the move to run in the background. When successful, it returns a network move ID.
  • Use the network move ID with the Get Network Move API to check the current status.
  • To test a move without changing the network, add "simulate": true to the request.

Use the API method when you need to:

  • Automate network moves as part of a larger workflow.
  • Move multiple networks programmatically.
  • Integrate network moves with external systems or CI/CD pipelines.
  • Build custom tooling or scripts.

Compare methods

Feature Automation Workflow API method
Interface Dashboard GUI API calls
Best for One-off moves Automation and bulk operations
Technical skill No coding required API or scripting knowledge required
Validation Built into the workflow Run with simulate mode
Progress monitoring Workflow UI Get Network Move API
Error reporting Messages in the workflow UI JSON error responses
Audit trail Automation execution logs API logs and Organization Change Log
Bulk operations One network at a time Script multiple moves

Verify a successful network move

After the move completes, check the following:

  1. Organization Change Log: Check both the source and destination organizations under Organization > Monitor > Change Log.
  2. Device status: Confirm that devices appear online in the destination organization under Network-wide > Monitor > Clients.
  3. Configuration: Spot-check key settings, including VLANs and subnets, SSID configurations, firewall rules, and switch port configurations.
  4. Client connectivity: Confirm that clients can connect to wireless networks and reach required resources.
  5. Licensing: Verify that devices are properly licensed in the destination organization under Organization > Licenses.

Post-move action required: If the network used VPN before the move, reconfigure it as a third-party VPN peer to maintain connectivity with the original organization. See VPN reconfiguration.

FAQ

What happens to device operation during or after a network move?

During the move, devices are moved with their network so device-specific configuration is preserved. There may be a brief disruption while the move is running.

Auto VPN works only for Meraki security appliances in the same dashboard organization. If you move a Meraki MX appliance that acts as an Auto VPN peer to a new organization, reconfigure it as a third-party VPN peer to keep connectivity to devices in the original organization. Use Configuring Site-to-site VPN between MX Appliances in Different Organizations as a reference.

Unexpected downtime can occur if other networks depend on the network being moved. For example, moving a Meraki MX security appliance network to a new organization can cause issues if it acts as a VPN concentrator for a Meraki MR access point network in the original organization. Review dependencies before moving a network.

What is not copied between the original and new organizations?

Meraki security policy does not allow organization-level information to be copied into destination organizations during a network move. The move operation can move devices to an existing organization, but it does not transfer licenses between organizations. Reapply or validate licensing after the move is complete.

By default, recorded video in Meraki MV smart camera networks is lost when you migrate to a new organization. Historical data, including event logs and change log entries for the network and its devices, does not transfer during the move.

Organization-level settings that are not moved:

  • Network administrators and admin permissions
  • Licenses
  • Organization-wide policies and policy objects
  • Alert settings and notification rules
  • SAML and SSO configurations
  • API keys
  • Integrations such as webhooks and SIEM

Can network portability move networks to an organization in a different global region?

No. The source and destination organizations must use the same regional Dashboard domain. Cross-shard moves are available within a region, but Network Portability cannot move a network between meraki.com, meraki.cn, meraki.ca, and meraki.in.

Dashboard domains are:

  • meraki.com (North America, South America, Europe, Asia-Pacific)
  • meraki.cn (China)
  • meraki.ca (Canada)
  • meraki.in (India)

You can link multiple organizations in the same region under a single login by using the same username and password when creating a new organization.

How long does a network move take?

Most network moves complete in less than 20 minutes after they start processing. Timing depends on:

  • The number of devices in the network
  • The complexity of the configuration
  • The number of moves queued ahead of yours
  • Current system load

Network moves are queued and run sequentially. Use the Get Network Move API with your move ID to monitor progress.

Can I move multiple networks at once?

Yes. You can start multiple network move operations. Each request is queued and run sequentially in the order received. Use a separate API call for each network move and keep each move ID so you can monitor them independently.

Glossary

Term Definition
Organization-wide Configuration or resources that exist at the organization level and are shared across multiple networks in that organization.
VRF (Virtual Routing and Forwarding) Network segmentation that creates separate routing tables within the same organization for traffic isolation.
ECO (Extra Config Option) Advanced configuration option enabled by Meraki support for specific use cases outside standard Dashboard functionality.
Policy object/group Reusable definition of IP addresses, domains, or ports that can be referenced in firewall rules.
Shard A geographically distributed cluster of Dashboard infrastructure. Network Portability supports moves between shards in the same regional Dashboard domain when the source organization has Network Move API enabled under Organization > Early Access.
PDL (Per Device Licensing) Licensing model where each device has an individual license assigned to it.
Co-Term Legacy licensing model where all licenses in an organization share one expiration date.
Subscription Licensing Licensing model where networks are bound to subscription-based licenses with flexible terms.
Monitor-only mode Device management mode where the device is managed outside Dashboard but still sends monitoring data for visibility.
XDR (Extended Detection and Response) Security integration that provides threat detection and response capabilities across the organization.

Related documentation