Skip to main content

 

Cisco Meraki Documentation

Network Move Overview and FAQ

  1. Last updated
  2. Save as PDF

Overview

Network portability lets you move a network from one organization to another while keeping the network configuration and devices together. Use it when you need to reorganize networks across organizations without rebuilding the network from scratch.

Network move can be used with appliance, camera, switch, wireless, and combined networks.

You can move networks using either the Cisco Managed Automation Workflow in Dashboard or the Network Move API. Both methods run the same validation and move process.

Network moves run asynchronously. The API returns a move ID after accepting the request for background processing; the move continues after the response. Most moves complete in less than 20 minutes after processing starts, though timing can vary. Use the move ID to monitor the operation.

After a successful move, Dashboard logs the action in the Organization Change Log (Organization > Monitor > Change Log) for both the source and destination organizations.

Can my network be moved?

Use this section to check the most common requirements before attempting a network move. If any item does not apply to your network, review How to prepare your network for moving before starting the move.

Basic requirements

  • For API moves, the requesting user needs write access in the source organization. The same user email must have organization write-admin access in the destination organization.
  • The source and destination organizations use the same regional Dashboard domain: meraki.com, meraki.cn, meraki.ca, or meraki.in. Network Portability supports cross-shard moves within that region.
  • The network is not a template and is not bound to a template.
  • For Subscription-to-Subscription moves, unbind only if this network is actively bound to a subscription. Subscription-to-Co-Term and Subscription-to-PDL moves are not supported, even after unbinding.
  • Site-to-site VPN and Auto VPN are disabled.
  • SSID tunneling, also known as Layer 3 roaming, is disabled.
  • The network is not assigned to a network group.
  • No Catalyst firmware upgrades are pending.

If these requirements are met, continue to Network configuration restrictions and review the restrictions for the products in your network.

If one or more requirements are not met, resolve those issues before moving the network.

Network move workflow

Most network moves follow five stages: assess, prepare, execute, monitor, and validate.

Network move workflow showing five stages: assess, prepare, execute, monitor, and validate.

Prerequisites

Administrative and organization requirements

  • For API moves, the requesting user needs write access in the source organization. The same user email must have organization write-admin access in the destination organization. Workflow target permissions are separate; verify the selected target can access both organizations.
  • The source and destination organizations must use the same regional Dashboard domain. Cross-shard moves are supported within that region; cross-region moves are not supported.
  • The network must not be assigned to a network group.
  • No Catalyst firmware upgrades can be pending.

Configuration requirements

  • For a Subscription-to-Subscription move, unbind the network only if it is actively bound to a subscription. Subscription-to-Co-Term and Subscription-to-PDL moves are not supported, even after unbinding.
  • Site-to-site VPN and Auto VPN must be disabled.
  • SSID tunneling must be disabled.

Network configuration restrictions

Some configurations prevent network moves. The sections below separate permanent blockers from settings that can be changed before moving the network.

Permanent blockers: Networks with any of these conditions cannot be moved:

  • Systems Manager (SM) networks
  • Template networks or networks bound to templates
  • Networks containing Axis camera devices
  • Power networks
  • The current network owner has payout history in the source organization, or the network has an access-card batch

Configuration blockers

Configuration blockers include mismatched NAT Exceptions settings for MX networks with NAT enabled; a destination network name conflict; a pending Catalyst upgrade; an active background operation referencing the network; a port profile owned by another network; an IDS allow-list mismatch; an organization-wide policy assignment; a destination policy object or profile conflict; or a destination RADIUS server with the same host, port, and type but a different secret. See How to prepare your network for moving for common remediation steps.

Product-specific restrictions

Check the restrictions for each product type in your network.

Product Blocking setting What this means Where to check in Dashboard
MX
(Security Appliance)		 Organization-wide policy assignments Firewall rules reference policy objects or groups defined at the organization level.

Remove organization-wide policy assignments before the move and recreate them in the destination if needed.		 Organization > Policy objects
NAT Exceptions with Manual Inbound Firewall MX networks with NAT enabled require matching “NAT Exceptions with Manual Inbound Firewall” settings in both organizations  
BGP configuration Border Gateway Protocol routing is enabled. Security & SD-WAN > SD-WAN & Traffic Shaping > BGP
XDR integration Cisco XDR is enabled for the network. Organization > Configure > Settings
Cisco Umbrella integration Umbrella is configured at the organization level, on SSIDs, or in group policies. Organization > Configure > Integrations
Organization-wide VRFs Virtual Routing and Forwarding is used for Auto VPN or SD-WAN configurations. Organization > SD-WAN & Traffic Shaping > VRFs
Secure Access or SSE The network is enrolled in an organization-level Secure Access or Security Service Edge integration. Organization > Configure > Integrations > Cisco Secure Access
Trusted traffic exclusions The network receives trusted traffic exclusions through its effective security profile. Security & SD-WAN > Threat Protection > Trusted Traffic Exclusions
MR
(Wireless)		 External VPN concentrators SSIDs use Layer 3 roaming to VPN concentrators in other networks. Wireless > Configure > Access control. Check for "VPN" or "Concentrator".
Destination RADIUS conflict Destination has a RADIUS server with the same host, port, and type but a different secret. Organization-wide RADIUS use alone is allowed. Organization > Configure > RADIUS
Source trusted certificate reference An SSID references a source-organization trusted certificate. RadSec alone is not the blocker. Organization > Configure > RADIUS. Check for RadSec configurations.
MS
(Switch)		 Organization-wide VRFs VRFs are used for Layer 3 interfaces, static routes, OSPF, or switch fabrics such as EVPN/VXLAN. Organization > Configure > VRFs
Organization-wide RADIUS servers Destination has a RADIUS server with the same host, port, and type but a different secret. Organization-wide RADIUS use alone is allowed. Organization > Configure > RADIUS
BGP configuration Border Gateway Protocol routing is enabled on switches. Switch > Routing & DHCP > BGP
Switch fabric The network is linked to a switch fabric. Organization > Fabric
Port profile owned by another network A non-organization-wide profile used by the network is owned by another network. Organization > Configure > SmartPorts > Profiles or Automations
MV
(Camera)		 Active video access authorization Customer authorization for video access is active. Cameras > Monitor. Check for active authorizations.
Axis camera devices The network contains Axis-branded camera devices. Cameras > Monitor. Check device models.
All products Monitor-only devices Devices are configured in device-managed mode, also called monitor-only mode. Organization > Inventory. Check device management mode.
ECO admin tags Devices have admin tags that match organization-level Extra Config Options. Organization > Inventory. Check device tags.
Dashboard banners or messages Active organization-level dashboard messages or banners target the network. Organization > Alerts
Trusted certificate dependencies An SSID or encrypted syslog configuration references a trusted certificate in the source organization. Organization > Configure > Certificates
IdP integration The network uses an identity provider resource from the source organization. Organization > Monitor > Users
MG
(Cellular Gateway)		 eSIM-managed devices The network contains devices managed through an eSIM service. Organization > SIM Cards > Inventory

\n

Shared configuration restrictions

Condition What to do
Organization-wide policy assignment Remove the assignment before moving; recreate it in the destination if needed. Supported policy objects referenced by network rules can move.
Destination network with the same name Rename the source network.
Pending Catalyst firmware upgrade Wait for the upgrade to finish.
Active background operation referencing the network Wait for the operation to finish.
Port profile owned by another network Create a profile owned by the network being moved and update assignments.
IDS allow-list mismatch When IDS is enabled, make source and destination rules match.
Destination RADIUS conflict Resolve a same-host, same-port, same-type server with a different secret.
NAT Exceptions mismatch For MX networks with NAT enabled, match settings in both organizations.

Network moves do not move organization-level features such as administrators, licensing, or policies. If you also need organization-level settings, use Clone Networks and Organizations in Dashboard.

Licensing restrictions

Only the license combinations below are currently supported. Cisco is working to add more license move options.

A network that uses Smart Account or Virtual Account licensing cannot move while that configuration is attached. Remove the source-organization licensing configuration before the move. After the move, configure licensing again in the destination organization.

Same shard To Co-Term To PDL To Subscription
From Co-Term Supported Not currently supported Supported
From PDL Not currently supported Supported Supported
From Subscription Not currently supported Not currently supported Supported

Last updated September 1, 2026.

How to prepare your network for moving

If your network has configuration blockers, use the relevant steps below before attempting the move.

Network Portability does not restore configuration that you remove or disable before a move. Record the current settings, complete the move, and configure the feature again in the destination organization.

Disable site-to-site VPN or Auto VPN

  1. Go to Security & SD-WAN > Site-to-site VPN.
  2. Document the current VPN settings, peer configurations, and routes.
  3. Change VPN mode to None or Off.
  4. Save changes and wait 2-3 minutes for the configuration to propagate.
  5. Proceed with the network move.
  6. After the move, reconfigure VPN as a third-party VPN peer if the network still needs connectivity to the original organization. See VPN reconfiguration in the FAQ.

Disable SSID tunneling (Layer 3 roaming)

  1. Go to Wireless > Configure > Access control.
  2. For each SSID using tunneling:
    • Document the current concentrator configuration.
    • Change the Concentrator setting to None or Local LAN.
  3. Save changes.
  4. Proceed with the network move.

Unbind subscriptions, if applicable

  1. Go to Organization > Licenses.
  2. Locate the network in the subscription view.
  3. Select Unbind network from subscription.
  4. Confirm the action.
  5. Proceed with the network move.
  6. After the move, bind the network to a subscription in the destination organization.

Remove network group assignment

  1. Go to Organization > Network groups.
  2. Locate the network group that contains the network.
  3. Select the network and choose Remove from group.
  4. Confirm the action.
  5. Proceed with the network move.

Remove trusted certificate dependencies

  1. Go to Organization > Configure > Certificates.
  2. Find SSIDs and encrypted syslog settings that reference trusted certificates from the source organization.
  3. Record the certificate assignments, then detach those references.
  4. Move the network.
  5. Import or recreate the certificates in the destination organization and attach the SSID and syslog settings to the new certificate records.

Remove organization-level IdP dependencies

  1. Go to Organization > Monitor > Users.
  2. Record the IdP settings and remove the network's dependency on the source IdP resource.
  3. Disable/change any setting using Meraki Authentication (SSID authentication, Client VPN, AnyConnect VPN).
  4. Move the network.
  5. Recreate the integration in the destination organization or attach the network to an existing destination IdP resource.

Remove switch fabric membership

  1. Go to Organization > Fabric.
  2. Record the fabric configuration and remove the network from the fabric.
  3. Move the network, then configure fabric membership in the destination organization if needed.

Resolve port profile ownership

  1. Go to Organization > Configure > SmartPorts.
  2. If a non-organization-wide profile is owned by another network, create a profile owned by this network and update assignments. Organization-wide profiles are not the blocker.
  3. Move the network.
  4. Recreate or select destination resources only if the network still needs them.

Disable Secure Access or SSE

  1. Go to Organization > Configure > Integrations > Cisco Secure Access.
  2. Record the current settings and remove the network from the source organization's Secure Access or SSE setup.
  3. Move the network.
  4. Enroll or enable the network in the destination organization's SSE setup.

Remove trusted traffic exclusions

  1. Go to Security & SD-WAN > Threat Protection > Trusted Traffic Exclusions.
  2. Record and remove the exclusions applied through the network's effective security profile.
  3. Move the network, then recreate the exclusions in the destination organization if needed.

Remove eSIM-managed devices

  1. Go to Organization > SIM Cards > Inventory.
  2. Identify the eSIM-managed devices in the network and remove them before the move.
  3. Move the network, then add and configure the devices in the destination organization.

Remove Smart Account or Virtual Account licensing

  1. Go to Network-wide > Management Mode.
  2. Record and remove the source organization's Smart Account or Virtual Account configuration.
  3. Move the network, then configure the destination organization's licensing association.

Destination already has a network with the same name

  1. Rename the source network before retrying.

Use simulate mode to test

Before executing an actual move, you can test the request with simulate mode.

  1. Call the Create Network Move API with "simulate": true.
  2. The API runs validation checks without moving the network.
  3. Review any returned errors to identify blocking configurations.
  4. Resolve the reported issues.
  5. Run simulate mode again to confirm that the blockers are resolved.
  6. Execute the actual move with "simulate": false, or omit the parameter.

New validation errors

Simulate mode may return one or more of the errors below. The API and Cisco Managed Automation Workflow use the same validation.

Error message What to do
Cannot move network: This network uses Smart Account / Virtual Account licensing configuration that is not preserved by Network Portability today. Please remove the configuration before moving the network, then recreate it after the move. Remove the source licensing association. Configure licensing again in the destination organization after the move.
Cannot move network: This network references organization-level trusted certificates that are not preserved by Network Portability. Please remove the trusted certificate dependencies before moving the network, then recreate them after the move. Detach trusted certificates from SSIDs and encrypted syslog settings. Import or recreate the certificates in the destination organization and attach the settings to the destination certificate records.
Cannot move network: This network uses IdP integrations that are not preserved by Network Portability today. Remove the IdP-related configuration before moving the network, then recreate it after the move. Remove the source IdP dependency. Recreate the integration or use an existing IdP resource in the destination organization.
Cannot move network: Networks linked to a switch fabric are not supported for network moves. Please remove the switch fabric configuration before retrying the move. Remove the network from the fabric before the move. Configure fabric membership again in the destination organization if needed.
Cannot move network: This network uses a non-organization-wide port profile owned by another network. Create a profile owned by the network being moved and update assignments before retrying. Create a profile owned by the network being moved and update its assignments.
Cannot move network: This network participates in Secure Access / SSE, which Network Portability does not preserve today. Please disable the Secure Access / SSE-related configuration before running the network move, then enable it again after the move. Remove the network from the source SSE setup. Enroll or enable it in the destination organization's SSE setup after the move.
Cannot move network: This network has trusted traffic exclusions applied through its effective security profile. Please remove the trusted traffic exclusions before moving the network, then recreate them after the move. Remove the exclusions before the move and recreate them in the destination organization afterward if needed.
Cannot move network: Networks with eSIM-managed devices are not supported by Network Portability today. Please remove eSIM-managed devices from the network before performing the move. Remove the eSIM-managed devices, move the network, then add and configure the devices in the destination organization.

Automation Workflow destination organization retrieval error.

Verify that the Automation Workflow target exists and has access to both organizations.

Moving a network

After the prerequisites are complete, you can move networks between organizations using one of these methods:

  • Cisco Managed Automation Workflow: Dashboard-based workflow, best for one-off moves and users who do not need scripting.
  • Network Move API: Programmatic method for automation, scripting, and bulk operations.

Both methods use the same validation and move process.

Method 1: Cisco Managed Automation Workflow

The Cisco Managed Automation Workflow provides a guided Dashboard experience for moving a network to another organization.

Create an Automation target under Automations > Targets. Verify separately that the target exists and has access to both the source and destination organizations. The default "Meraki - Current Org" target may not provide destination access.

Access the automation workflow

  1. Log in to the Meraki Dashboard.
  2. Go to Organization > Automation > Exchange.
  3. Find the workflow named Move Network to Another Organization.
  4. Open the workflow tile.
  5. Click Run Workflow.

Configure the workflow

The workflow asks for these inputs:

Parameter Description Required
Source Organization The organization that currently contains the network. Yes
Network to Move The network within the source organization. Yes
Destination Organization The organization where the network should be moved. Yes
Simulate Mode Validates the move without executing it. No

Run the workflow

  1. Select the source organization, network, and destination organization from the dropdown menus.
  2. Enable simulate mode first if you want to validate prerequisites without moving the network.
  3. Review the selected inputs.
  4. Click Run.
  5. Monitor the workflow as it validates prerequisites, checks for configuration blockers, queues the move, monitors progress, and reports the final status.

Benefits of the Automation Workflow

  • It walks you through the required inputs.
  • It checks prerequisites before attempting the move.
  • It shows progress and status updates while the move runs.
  • It returns clear error messages when a prerequisite is not met.
  • It does not require API or scripting knowledge.
  • It records the workflow run in Automation logs.

Workflow execution logs

After running the workflow, you can review execution details.

  1. Go to Organization > Automation > Executions.
  2. Locate the Move Network to Another Organization workflow run.
  3. Open the run to view validation results, the move ID, errors or warnings, and the completion timestamp.

Method 2: Network Move API

Use the Network Move API when you need to script moves, integrate them into another system, or manage moves at scale.

API workflow

  • Start a network move by calling the Create Network Move API. The API submits the move for background processing and returns a move ID. This response means the request was accepted; it does not mean the move has completed.
  • Use the move ID with Get Network Moves to monitor pending, in progress, failed, completed, or invalidated status. A simulated move ends as invalidated after the dry run.
  • To test without committing the move, add "simulate": true. A successful simulation requires a new non-simulated request to perform the move.

Use the API method when you need to:

  • Automate network moves as part of a larger workflow.
  • Move multiple networks programmatically.
  • Integrate network moves with external systems or CI/CD pipelines.
  • Build custom tooling or scripts.

Compare methods

Feature Automation Workflow API method
Interface Dashboard GUI API calls
Best for One-off moves Automation and bulk operations
Technical skill No coding required API or scripting knowledge required
Validation Built into the workflow Run with simulate mode
Progress monitoring Workflow UI Get Network Move API
Error reporting Messages in the workflow UI JSON error responses
Audit trail Automation execution logs API logs and Organization Change Log
Bulk operations One network at a time Script multiple moves

Verify a successful network move

After the move completes, check the following:

  1. Organization Change Log: Check both the source and destination organizations under Organization > Monitor > Change Log.
  2. Device status: Confirm that devices appear online in the destination organization under Network-wide > Monitor > Clients.
  3. Configuration: Spot-check key settings, including VLANs and subnets, SSID configurations, firewall rules, and switch port configurations.
  4. Client connectivity: Confirm that clients can connect to wireless networks and reach required resources.
  5. Licensing: Verify licensing in the destination organization under Organization > Licenses.
  6. MV video: Same-shard moves retain recorded video; cross-shard moves do not retain recorded video by default.

Post-move action required: If a moved MX was an Auto VPN peer in the source organization and still needs connectivity to that organization, configure it as a third-party VPN peer. See VPN reconfiguration.

FAQ

What happens to device operation during or after a network move?

During the move, devices move with their network. There may be a brief disruption while the move is running.

Auto VPN works only for Meraki security appliances in the same dashboard organization. If you move a Meraki MX appliance that acts as an Auto VPN peer to a new organization, reconfigure it as a third-party VPN peer to keep connectivity to devices in the original organization. Use Configuring Site-to-site VPN between MX Appliances in Different Organizations as a reference.

Unexpected downtime can occur if other networks depend on the network being moved. For example, moving a Meraki MX security appliance network to a new organization can cause issues if it acts as a VPN concentrator for a Meraki MR access point network in the original organization. Review dependencies before moving a network.

What is not copied between the original and new organizations?

Network Portability does not copy the entire source organization. Some supported resources used by the network can move with it. Check the licensing table for supported source-to-destination transitions. Organization-wide policy assignments may need to be removed before the move and recreated in the destination.

Same-shard moves retain recorded video. Cross-shard moves do not retain recorded video by default. Event-log and Change Log history are separate; retention depends on the history type and is not established here as universally retained or lost.

Organization-level settings that are not moved:

  • Network administrators and admin permissions
  • Organization licensing configuration. Check the licensing matrix for supported network transitions.
  • Organization-wide policy assignments (supported policy objects referenced by network rules can move with the network)
  • Alert settings and notification rules
  • SAML and SSO configurations
  • API keys
  • Integrations such as webhooks and SIEM

Can network portability move networks to an organization in a different global region?

No. The source and destination organizations must use the same regional Dashboard domain. Cross-shard moves are available within a region, but Network Portability cannot move a network between meraki.com, meraki.cn, meraki.ca, and meraki.in.

Dashboard domains are:

  • meraki.com (North America, South America, Europe, Asia-Pacific)
  • meraki.cn (China)
  • meraki.ca (Canada)
  • meraki.in (India)

You can link multiple organizations in the same region under a single login by using the same username and password when creating a new organization.

How long does a network move take?

Most network moves complete in less than 20 minutes after they start processing. Timing depends on:

  • The number of devices in the network
  • The complexity of the configuration
  • Current system load

Use Get Network Moves with the move ID to monitor progress. A successful simulation validates the request but does not move the network; submit a new non-simulated request to perform the move.

Can I move multiple networks at once?

Yes. You can start multiple network move operations. The API does not guarantee start or completion order across different networks. Use a separate API call for each network move and keep each move ID so you can monitor them independently.

Glossary

Term Definition
Organization-wide Configuration or resources that exist at the organization level and are shared across multiple networks in that organization.
VRF (Virtual Routing and Forwarding) Network segmentation that creates separate routing tables within the same organization for traffic isolation.
ECO (Extra Config Option) Advanced configuration option enabled by Meraki support for specific use cases outside standard Dashboard functionality.
Policy object/group Reusable definition of IP addresses, domains, or ports that can be referenced in firewall rules.
Shard A geographically distributed cluster of Dashboard infrastructure. Network Portability supports cross-shard moves within the same regional Dashboard domain.
PDL (Per Device Licensing) Licensing model where each device has an individual license assigned to it.
Co-Term Legacy licensing model where all licenses in an organization share one expiration date.
Subscription Licensing Licensing model where networks are bound to subscription-based licenses with flexible terms.
Monitor-only mode Device management mode where the device is managed outside Dashboard but still sends monitoring data for visibility.
XDR (Extended Detection and Response) Security integration that provides threat detection and response capabilities across the organization.

Related documentation