Network Move / Network Portability Overview

Overview

Network portability allows you to move networks between your organizations, including configuration and all devices in the network. This is designed for network administrators to re-organize networks as they see fit and allow for a better experience when managing networks across multiple organizations.

Network move can be used on appliance, camera, switch, wireless and combined networks.

You can move networks using either the Cisco Managed Automation Workflow (GUI-based, recommended for most users) or the Network Move API (programmatic method for automation). Both methods perform the same validation and move operations.

Network moves execute as a background process and will generally complete in less than 20 minutes from the start, though this time is highly dependent on the number of nodes in the network and the number of moves pending.

Once complete, successful network moves are logged in the Organization Change Log (Organization > Monitor > Change Log) for both the source and destination organizations.

In order to balance performance for all users, network moves may not be started immediately.

Multiple API calls to create network moves will be executed sequentially in the order received.

Can My Network Be Moved? Quick Checklist

Use this checklist to quickly determine if your network is eligible for portability. If you answer "No" to any item, see the detailed sections below for remediation guidance.

✅ Basic Requirements

☐ I have full organization admin rights in both source and destination organizations
☐ Organizations are on the same shard (same dashboard domain: meraki.com, meraki.cn, meraki.ca, or meraki.in)
☐ Network is not a template and not bound to templates
☐ All subscription licenses are unbound from the network
☐ Site-to-Site VPN and Auto VPN are disabled
☐ SSID Tunneling (Layer 3 roaming) is disabled
☐ Network is not assigned to a network group
☐ No pending firmware upgrades are scheduled

If you checked all boxes above, continue to Network Configuration Restrictions to verify your specific product configurations.

If you cannot check all boxes, see How to Prepare Your Network for Moving for step-by-step remediation guidance.

Network Move Workflow

Understanding the network move process:

┌─────────────────────────────────────────────────────────────────┐
│ Step 1: Pre-Move Assessment                                     │
│    ☐ Review quick checklist above                               │
│    ☐ Check configuration restrictions for your products         │
│    ☐ Verify licensing compatibility                             │
│    ☐ Use simulate mode to test without changes                  │
└─────────────────┬───────────────────────────────────────────────┘
                  │
┌─────────────────▼───────────────────────────────────────────────┐
│ Step 2: Preparation                                             │
│    ☐ Disable VPN/tunneling (if present)                         │
│    ☐ Unbind subscriptions (if present)                          │
│    ☐ Remove network group assignments (if present)              │
│    ☐ Document current configuration (screenshots recommended)   │
└─────────────────┬───────────────────────────────────────────────┘
                  │
┌─────────────────▼───────────────────────────────────────────────┐
│ Step 3: Execute Move (Choose Method)                            │
│    Option A - Automation Workflow (Recommended):                │
│      → Navigate to Organization > Automation > Exchange         │
│      → Run "Move Network to Another Organization" workflow      │
│      → Workflow handles validation and execution automatically  │
│                                                                 │
│    Option B - API Method:                                       │
│      → API: POST /organizations/{orgId}/networks/moves          │
│      → Returns: Move ID                                         │
│      → Status: Queued → In Progress (typically < 20 minutes)    │
└─────────────────┬───────────────────────────────────────────────┘
                  │
┌─────────────────▼───────────────────────────────────────────────┐
│ Step 4: Monitor Progress                                        │
│    Automation Workflow: Real-time status in workflow UI         │
│    API Method: Poll GET /networks/moves/{moveId}                │
└─────────────────┬───────────────────────────────────────────────┘
                  │
┌─────────────────▼───────────────────────────────────────────────┐
│ Step 5: Post-Move Validation                                    │
│    ☐ Verify devices appear online in destination org            │
│    ☐ Verify licensing in destination org                        │
│    ☐ Reconfigure VPN as third-party peer (if needed)            │
│    ☐ Review change logs in both organizations                   │
└─────────────────────────────────────────────────────────────────┘

Prerequisites

Administrative and Organizational Requirements

The API user must have full organization admin rights in both the source and destination organizations.
The source and destination organizations must be on the same shard (same dashboard domain).
Networks must not be assigned to network groups.
No pending firmware upgrades can be scheduled for devices in the network.

Configuration Requirements

All subscription licenses must be unbound from the network before moving.
Site-to-Site VPN and Auto VPN must be disabled.
SSID Tunneling must be disabled.

Network Configuration Restrictions

Networks with certain product-specific configurations cannot be moved. These restrictions are organized by severity and product type.

⛔ Permanent Blockers - Networks with these conditions cannot be moved under any circumstances:

Systems Manager (SM) networks
Template networks or networks bound to templates
Networks that have organization-wide group policy settings
Networks with no devices
Wireless networks that have ever used billing on any configured SSIDs - this can be verified by determining if Wireless > Configure > Billing payout exists in the network; if this page exists, the network cannot be moved
Networks containing Axis camera devices
Networks with billing/payout history
Organizations that have mismatched 'NAT Exceptions with Manual Inbound Firewall' settings between source and destination

⚠️ Configuration Blockers - Networks with these settings can be moved after resolving the configuration (see How to Prepare section):

Product-Specific Restrictions

Review the restrictions for products in your network:

Product	Restriction Type	What This Means	Where to Check in Dashboard
MX (Security Appliance)	Organization-wide Policy Objects	Firewall rules reference policy objects or groups defined at the organization level	Organization > Policy objects
	BGP Configuration	Border Gateway Protocol routing is enabled	Security & SD-WAN > SD-WAN & Traffic Shaping > BGP
	XDR Integration	Extended Detection and Response integration enabled at organization level	Organization > Configure > Settings
	Cisco Umbrella Integration	Umbrella integration configured at organization level, on SSIDs, or group policies	Organization > Configure > Integrations
	Organization-wide VRFs	Virtual Routing and Forwarding used for AutoVPN or SD-WAN configurations	Organization > SD-WAN & Traffic Shaping > VRFs
MR (Wireless)	External VPN Concentrators	SSIDs configured for Layer 3 roaming to VPN concentrators in other networks	Wireless > Configure > Access control > Check for "VPN" or "Concentrator"
MR (Wireless)	Organization-wide RADIUS Servers	SSIDs reference RADIUS servers defined at the organization level	Organization > Configure > RADIUS
MS (Switch)	Organization-wide VRFs	VRFs used for Layer 3 interfaces, static routes, OSPF, or switch fabrics (EVPN/VXLAN)	Organization > Configure > VRFs
	Organization-wide RADIUS Servers	Access policies reference RADIUS servers defined at the organization level	Organization > Configure > RADIUS
	BGP Configuration	Border Gateway Protocol routing is enabled on switches	Switch > Routing & DHCP > BGP
MV (Camera)	Active Video Access Authorization	Customer authorization for video access is currently active	Cameras > Monitor > Check for active authorizations
MV (Camera)	Axis Camera Devices	Network contains Axis-branded camera devices	Cameras > Monitor > Check device models
All Products	Monitor-only Devices	Devices configured in device-managed mode (monitor-only)	Organization > Inventory > Check device management mode
	ECO Admin Tags	Devices have admin tags that match organization-level Extra Config Options	Organization > Inventory > Check device tags
	Dashboard Banners/Messages	Active organization-level dashboard messages or banners targeting the network	Organization > Alerts

In addition, organization-level features like network administrators, licensing or policies are not moved. If you need organization-level settings as well, you can Clone Networks and Organizations in Dashboard.

Licensing Restrictions

Moving between certain license combinations is available at this time and we are working to add more license type moves.

Same Shard	To Co-Term	To PDL	To Subscription
From Co-Term	✅ Working	⛔ not currently supported ⛔	⛔ not currently supported ⛔
From PDL	⛔ not currently supported ⛔	⚠️ License needs to be removed from devices before moving ⚠️	⛔ not currently supported ⛔
From Subscription	⛔ not currently supported ⛔	⛔ not currently supported ⛔	⚠️ Network needs to be unbound from the subscription before moving ⚠️

Last updated April 1, 2026

How to Prepare Your Network for Moving

If your network has configuration blockers (⚠️), follow these steps to prepare it for moving:

Disabling Site-to-Site VPN or Auto VPN

Navigate to Security & SD-WAN > Site-to-site VPN
Document your configuration - Take screenshots of all VPN settings, peer configurations, and routes
Change VPN mode to "None" or "Off"
Save changes and wait 2-3 minutes for configuration to propagate
Proceed with network move
After the move: If you need to maintain VPN connectivity to the original organization, reconfigure as a third-party VPN peer (see VPN Reconfiguration in FAQ)

Disabling SSID Tunneling (Layer 3 Roaming)

Navigate to Wireless > Configure > Access control
For each SSID using tunneling:
- Document the current concentrator configuration
- Change "Concentrator" setting to "None" or "Local LAN"
Save changes
Proceed with network move

Removing Organization-wide Policy Objects

Navigate to Security & SD-WAN > Firewall
Review all firewall rules and identify those using organization-wide policy objects (look for objects with "Organization" scope)
Option A - Replace with local objects:
- In the destination organization, create equivalent policy objects at the network level
- Update firewall rules to reference the local objects
Option B - Replace with explicit values:
- Replace policy object references with explicit IP addresses or CIDR ranges
Save changes
Proceed with network move

Unbinding Subscriptions

Navigate to Organization > Licenses
Locate the network in the subscription view
Select "Unbind network from subscription"
Confirm the action
Proceed with network move
After the move: Bind the network to a subscription in the destination organization

Removing Network Group Assignment

Navigate to Organization > Network groups
Locate the network group containing your network
Select the network and choose "Remove from group"
Confirm the action
Proceed with network move

Resolving Organization-wide RADIUS Servers

Navigate to Organization > Configure > RADIUS
Document the RADIUS server configurations (hostnames, ports, secrets)
Option A - Create in destination org first:
- In the destination organization, create equivalent organization-wide RADIUS servers
- Proceed with network move (SSIDs/policies will automatically reference the destination org servers if names match)
Option B - Convert to network-local RADIUS:
- Reconfigure SSIDs or access policies to use network-specific RADIUS servers instead of organization-wide servers
- Proceed with network move

Using Simulate Mode to Test

Before executing an actual move, you can test the process using simulate mode:

Call the Create Network Move API with parameter "simulate": true
The API will perform all validation checks without actually moving the network
Review any error messages returned to identify blocking configurations
Resolve identified issues
Re-run simulate mode to confirm all blockers are resolved
Execute the actual move with "simulate": false (or omit the parameter)

Moving a Network

Once the prerequisites are completed, you can move networks between organizations on the same shard using one of two methods:

Cisco Managed Automation Workflow - GUI-based workflow in Dashboard (recommended for most users)
Network Move API - Programmatic API method for automation and scripting

Both methods perform the same validation and move process. Choose the method that best fits your workflow.

Method 1: Cisco Managed Automation Workflow (Recommended)

The Cisco Managed Automation Workflow provides a guided, GUI-based experience for moving networks through the Dashboard. This method is ideal for users who prefer a visual interface and step-by-step guidance.

Accessing the Automation Workflow

Log in to the Meraki Dashboard
Navigate to Organization > Automation > Exchange
Search for or locate the workflow named "Move Network to Another Organization"
Click on the workflow tile to open it
Click "Run Workflow" to begin

Configuring the Workflow

The automation workflow will guide you through the configuration with the following inputs:

Parameter	Description	Required
Source Organization	The organization that currently contains the network you want to move	Yes
Network to Move	The specific network within the source organization	Yes
Destination Organization	The organization where you want to move the network	Yes
Simulate Mode	When enabled, validates the move without executing it (recommended for first run)	No

Running the Workflow

Configure Inputs: Select the source organization, network, and destination organization from the dropdown menus
Enable Simulate Mode (Recommended): On your first run, enable simulate mode to validate prerequisites without actually moving the network
Review Configuration: Verify all selections are correct
Execute: Click "Run" to start the workflow
Monitor Progress: The workflow will display real-time status as it:
- Validates prerequisites
- Checks for configuration blockers
- Queues the network move
- Monitors move progress
- Reports completion status

Benefits of the Automation Workflow:

Guided Experience: Step-by-step interface with validation at each stage
Built-in Validation: Automatically checks prerequisites before attempting the move
Real-time Feedback: Shows progress and status updates throughout the process
Error Handling: Provides clear error messages if prerequisites are not met
No Coding Required: GUI-based interface, no API knowledge needed
Audit Trail: Workflow execution is logged in Automation logs

Workflow Execution Logs

After running the workflow, you can review execution details:

Navigate to Organization > Automation > Executions
Locate the "Move Network to Another Organization" workflow run
Click to view detailed logs, including:
- Validation results
- Move ID (for status tracking)
- Any errors or warnings encountered
- Completion timestamp

Method 2: Network Move API (Programmatic)

The Network Move API provides programmatic access for automation and scripting use cases. This method is ideal for users who need to integrate network moves into automated workflows or manage moves at scale.

API Workflow

A network move is started by calling the Create Network Move API, which will queue the network move to run in the background. When successful, this API will return an ID for the network move.
This network move ID can then be used with the Get Network Move API to see the current status of the move process.
A network move can be simulated in a non-destructive way by adding the parameter "simulate": true.

When to Use the API Method:

Automating network moves as part of a larger workflow
Moving multiple networks programmatically
Integrating with external systems or CI/CD pipelines
Building custom tooling or scripts

Comparing Methods

Feature	Automation Workflow	API Method
Interface	GUI-based in Dashboard	Programmatic API calls
Best For	One-off moves, visual learners	Automation, bulk operations
Technical Skill	No coding required	API/scripting knowledge needed
Validation	Built-in, automatic	Manual via simulate mode
Progress Monitoring	Real-time in workflow UI	Poll via Get Network Move API
Error Reporting	User-friendly messages in UI	JSON error responses
Audit Trail	Automation execution logs	API logs + Change Log
Bulk Operations	One network at a time	Script multiple moves

Verifying a Successful Network Move

After the move completes, verify success by checking:

Organization Change Log: Check both source and destination organizations (Organization > Monitor > Change Log) for network move completion entries
Device Status: Verify all devices appear online in the destination organization's network (Network-wide > Monitor > Clients)
Configuration Preservation: Spot-check key settings to confirm they were preserved:
- VLANs and subnets
- SSID configurations
- Firewall rules
- Switch port configurations
Client Connectivity: Test that clients can connect to wireless networks and access resources
Licensing: Verify devices are properly licensed in the destination organization (Organization > Licenses)

Post-Move Action Required: If your network used VPN before the move, you must reconfigure it as a third-party VPN peer to maintain connectivity with the original organization (see VPN Reconfiguration FAQ below).

FAQ

What is the impact on device operation during/after a network move?

During the network move process, there is minimal downtime while devices are moved with their corresponding network. This allows the move to take place without any loss of device-specific configuration. Please note there may be a momentary disruption in operation during the network move itself.

Auto VPN works only for Meraki security appliances in the same dashboard organization. If you move a Meraki MX appliance that acts as an Auto VPN peer to a new organization, you must reconfigure it as a third-party VPN peer to maintain its connection to devices in the original organization. Use the article "Configuring Site-to-site VPN between MX Appliances in Different Organizations" as a reference to set up the third-party VPN tunnel.

Unexpected downtime can occur if you move networks that other networks depend on. For example, moving a Meraki MX security appliance network to a new organization can cause issues if it acts as a VPN concentrator for a Meraki MR access point network in the original organization. Review all dependencies before moving a network.

What isn't copied between the original and new organizations?

Meraki security policy does not allow copying information into destination organizations during a network move. The move operation does not transfer licenses between organizations, but it can move devices to an existing organization. You must reapply or validate licensing after the move is complete.

By default, recorded video in Meraki MV smart camera networks is lost when you migrate to a new organization. No historical data, including event logs and changelog entries for the network and its devices, transfers during the move.

Organization-level settings that are NOT moved:

Network administrators and admin permissions
Licenses (must be reapplied in destination org)
Organization-wide policies and policy objects
Alert settings and notification rules
SAML/SSO configurations
API keys
Integrations (webhooks, SIEM, etc.)

Can network portability be used to move networks to an organization in a different global region?

This is not possible at the moment. You must create a new organization in the same shard within the same dashboard domain where the source organization is hosted as listed below. You can link multiple organizations in the same region under a single login by using the same username and password when creating a new organization.

meraki.com (North America, South America, Europe, Asia-Pacific)
meraki.cn (China)
meraki.ca (Canada)
meraki.in (India)

Cross-shard moves are available in Early Access for testing purposes only (see Internal FAQ below).

How long does a network move take?

Most network moves complete in less than 20 minutes from the time they start processing. However, timing depends on:

Number of devices in the network
Complexity of configuration
Number of other moves queued ahead of yours
Current system load

Network moves are queued and executed sequentially. You can monitor progress using the Get Network Move API with your move ID.

Can I move multiple networks at once?

Yes, you can initiate multiple network move operations. Each move request will be queued and executed sequentially in the order received. Use separate API calls for each network move and retain each move ID to monitor progress independently.

Glossary

Term	Definition
Organization-wide	Configuration or resources that exist at the organization level and are shared across multiple networks within that organization
VRF (Virtual Routing and Forwarding)	Network segmentation technology that creates separate routing tables within the same organization for traffic isolation
ECO (Extra Config Option)	Advanced configuration options enabled by Meraki support for specific use cases that extend beyond standard Dashboard functionality
Policy Object/Group	Reusable definitions of IP addresses, domains, or ports that can be referenced in firewall rules across multiple networks
Shard	A geographically-distributed cluster of Dashboard infrastructure. Organizations on the same shard can move networks between them; organizations on different shards cannot (except in Early Access)
PDL (Per Device Licensing)	Licensing model where each device has an individual license assigned to it
Co-Term	Legacy licensing model where all licenses in an organization share a common expiration date
Subscription Licensing	Modern licensing model where networks are bound to subscription-based licenses with flexible terms
Monitor-only Mode	Device management mode where the device is managed outside of Dashboard but sends monitoring data for visibility
XDR (Extended Detection and Response)	Security integration that provides advanced threat detection and response capabilities across the organization