Network Move Overview and FAQ

Overview

Network portability lets you move a network from one organization to another while keeping the network configuration and devices together. Use it when you need to reorganize networks across organizations without rebuilding the network from scratch.

Network move can be used with appliance, camera, switch, wireless, and combined networks.

You can move networks using either the Cisco Managed Automation Workflow in Dashboard or the Network Move API. Both methods run the same validation and move process.

Network moves run in the background. Most complete in less than 20 minutes after processing starts, although timing depends on the number of devices in the network and the number of moves already queued.

After a successful move, Dashboard logs the action in the Organization Change Log (Organization > Monitor > Change Log) for both the source and destination organizations.

To keep Dashboard services responsive for all users, network moves may not start immediately.

If you create multiple network moves through the API, Dashboard runs them sequentially in the order received.

Can my network be moved?

Use this section to check the most common requirements before attempting a network move. If any item does not apply to your network, review How to prepare your network for moving before starting the move.

Basic requirements

You have full organization admin rights in both the source and destination organizations.
The source and destination organizations are on the same shard, meaning they use the same dashboard domain: meraki.com, meraki.cn, meraki.ca, or meraki.in.
The network is not a template and is not bound to a template.
All subscription licenses are unbound from the network.
Site-to-site VPN and Auto VPN are disabled.
SSID tunneling, also known as Layer 3 roaming, is disabled.
The network is not assigned to a network group.
No firmware upgrades are pending for devices in the network.

If these requirements are met, continue to Network configuration restrictions and review the restrictions for the products in your network.

If one or more requirements are not met, resolve those issues before moving the network.

Network move workflow

Most network moves follow five stages: assess, prepare, execute, monitor, and validate.

Network move workflow showing five stages: assess, prepare, execute, monitor, and validate.

Prerequisites

Administrative and organization requirements

The Dashboard or API user must have full organization admin rights in both the source and destination organizations.
The source and destination organizations must be on the same shard, meaning they use the same dashboard domain.
The network must not be assigned to a network group.
No firmware upgrades can be pending for devices in the network.

Configuration requirements

All subscription licenses must be unbound from the network before the move.
Site-to-site VPN and Auto VPN must be disabled.
SSID tunneling must be disabled.

Network configuration restrictions

Some configurations prevent network moves. The sections below separate permanent blockers from settings that can be changed before moving the network.

Permanent blockers

Networks with any of these conditions cannot be moved:

Systems Manager (SM) networks
Template networks or networks bound to templates
Networks that have organization-wide group policy settings
Networks with no devices
Wireless networks that have ever used billing on any configured SSID. To check, go to Wireless > Configure > Billing. If the billing payout page exists for the network, the network cannot be moved.
Networks containing Axis camera devices
Networks with billing or payout history
Organizations with mismatched NAT Exceptions with Manual Inbound Firewall settings between source and destination

Configuration blockers

The settings below can block a move, but you may be able to resolve them before trying again. See How to prepare your network for moving for common remediation steps.

Product-specific restrictions

Check the restrictions for each product type in your network.

Product	Blocking setting	What this means	Where to check in Dashboard
MX (Security Appliance)	Organization-wide policy objects	Firewall rules reference policy objects or groups defined at the organization level.	Organization > Policy objects
	BGP configuration	Border Gateway Protocol routing is enabled.	Security & SD-WAN > SD-WAN & Traffic Shaping > BGP
	XDR integration	Extended Detection and Response is enabled at the organization level.	Organization > Configure > Settings
	Cisco Umbrella integration	Umbrella is configured at the organization level, on SSIDs, or in group policies.	Organization > Configure > Integrations
	Organization-wide VRFs	Virtual Routing and Forwarding is used for Auto VPN or SD-WAN configurations.	Organization > SD-WAN & Traffic Shaping > VRFs
MR (Wireless)	External VPN concentrators	SSIDs use Layer 3 roaming to VPN concentrators in other networks.	Wireless > Configure > Access control. Check for "VPN" or "Concentrator".
	Organization-wide RADIUS servers	SSIDs reference RADIUS servers defined at the organization level.	Organization > Configure > RADIUS
	RadSec with organization CA	SSIDs use RadSec with an organization-level CA certificate.	Organization > Configure > RADIUS. Check for RadSec configurations.
MS (Switch)	Organization-wide VRFs	VRFs are used for Layer 3 interfaces, static routes, OSPF, or switch fabrics such as EVPN/VXLAN.	Organization > Configure > VRFs
	Organization-wide RADIUS servers	Access policies reference RADIUS servers defined at the organization level.	Organization > Configure > RADIUS
	BGP configuration	Border Gateway Protocol routing is enabled on switches.	Switch > Routing & DHCP > BGP
MV (Camera)	Active video access authorization	Customer authorization for video access is active.	Cameras > Monitor. Check for active authorizations.
MV (Camera)	Axis camera devices	The network contains Axis-branded camera devices.	Cameras > Monitor. Check device models.
All products	Monitor-only devices	Devices are configured in device-managed mode, also called monitor-only mode.	Organization > Inventory. Check device management mode.
	ECO admin tags	Devices have admin tags that match organization-level Extra Config Options.	Organization > Inventory. Check device tags.
	Dashboard banners or messages	Active organization-level dashboard messages or banners target the network.	Organization > Alerts

Network moves do not move organization-level features such as administrators, licensing, or policies. If you also need organization-level settings, use Clone Networks and Organizations in Dashboard.

Licensing restrictions

Only the license combinations below are currently supported. Cisco is working to add more license move options.

Same shard	To Co-Term	To PDL	To Subscription
From Co-Term	Supported	Not currently supported	Not currently supported
From PDL	Not currently supported	Remove the license from devices before moving.	Not currently supported
From Subscription	Not currently supported	Not currently supported	Unbind the network from the subscription before moving.

Last updated April 1, 2026.

How to prepare your network for moving

If your network has configuration blockers, use the relevant steps below before attempting the move.

Disable site-to-site VPN or Auto VPN

Go to Security & SD-WAN > Site-to-site VPN.
Document the current VPN settings, peer configurations, and routes.
Change VPN mode to None or Off.
Save changes and wait 2-3 minutes for the configuration to propagate.
Proceed with the network move.
After the move, reconfigure VPN as a third-party VPN peer if the network still needs connectivity to the original organization. See VPN reconfiguration in the FAQ.

Disable SSID tunneling (Layer 3 roaming)

Go to Wireless > Configure > Access control.
For each SSID using tunneling:
- Document the current concentrator configuration.
- Change the Concentrator setting to None or Local LAN.
Save changes.
Proceed with the network move.

Remove organization-wide policy object references

Go to Security & SD-WAN > Firewall.
Review firewall rules and identify any rules that use organization-wide policy objects or groups.
Replace those policy object references with explicit IP addresses, CIDR ranges, domains, or ports.
Save changes.
Proceed with the network move.
After the move, recreate equivalent policy objects in the destination organization if needed, then update the rules to use them.

Unbind subscriptions

Go to Organization > Licenses.
Locate the network in the subscription view.
Select Unbind network from subscription.
Confirm the action.
Proceed with the network move.
After the move, bind the network to a subscription in the destination organization.

Remove network group assignment

Go to Organization > Network groups.
Locate the network group that contains the network.
Select the network and choose Remove from group.
Confirm the action.
Proceed with the network move.

Resolve organization-wide RADIUS servers

Go to Organization > Configure > RADIUS.
Document the RADIUS server configurations, including hostnames, ports, and secrets.
If you want to keep using organization-wide RADIUS servers, create equivalent organization-wide RADIUS servers in the destination organization before the move.
If you do not want to depend on organization-wide RADIUS servers, reconfigure SSIDs or access policies to use network-specific RADIUS servers.
Proceed with the network move.

RadSec with organization CA: If your SSIDs use RadSec with an organization-level CA certificate, recreate the organization CA in the destination organization before moving the network. See MR RADSec - Create the Organization CA.

Use simulate mode to test

Before executing an actual move, you can test the request with simulate mode.

Call the Create Network Move API with "simulate": true.
The API runs validation checks without moving the network.
Review any returned errors to identify blocking configurations.
Resolve the reported issues.
Run simulate mode again to confirm that the blockers are resolved.
Execute the actual move with "simulate": false, or omit the parameter.

Moving a network

After the prerequisites are complete, you can move networks between organizations on the same shard using either method below.

Cisco Managed Automation Workflow: Dashboard-based workflow, best for one-off moves and users who do not need scripting.
Network Move API: Programmatic method for automation, scripting, and bulk operations.

Both methods use the same validation and move process.

Method 1: Cisco Managed Automation Workflow

The Cisco Managed Automation Workflow provides a guided Dashboard experience for moving a network to another organization.

Access the automation workflow

Log in to the Meraki Dashboard.
Go to Organization > Automation > Exchange.
Find the workflow named Move Network to Another Organization.
Open the workflow tile.
Click Run Workflow.

Configure the workflow

The workflow asks for these inputs:

Parameter	Description	Required
Source Organization	The organization that currently contains the network.	Yes
Network to Move	The network within the source organization.	Yes
Destination Organization	The organization where the network should be moved.	Yes
Simulate Mode	Validates the move without executing it.	No

Run the workflow

Select the source organization, network, and destination organization from the dropdown menus.
Enable simulate mode first if you want to validate prerequisites without moving the network.
Review the selected inputs.
Click Run.
Monitor the workflow as it validates prerequisites, checks for configuration blockers, queues the move, monitors progress, and reports the final status.

Benefits of the Automation Workflow

It walks you through the required inputs.
It checks prerequisites before attempting the move.
It shows progress and status updates while the move runs.
It returns clear error messages when a prerequisite is not met.
It does not require API or scripting knowledge.
It records the workflow run in Automation logs.

Workflow execution logs

After running the workflow, you can review execution details.

Go to Organization > Automation > Executions.
Locate the Move Network to Another Organization workflow run.
Open the run to view validation results, the move ID, errors or warnings, and the completion timestamp.

Method 2: Network Move API

Use the Network Move API when you need to script moves, integrate them into another system, or manage moves at scale.

API workflow

Start a network move by calling the Create Network Move API. The API queues the move to run in the background. When successful, it returns a network move ID.
Use the network move ID with the Get Network Move API to check the current status.
To test a move without changing the network, add "simulate": true to the request.

Use the API method when you need to:

Automate network moves as part of a larger workflow.
Move multiple networks programmatically.
Integrate network moves with external systems or CI/CD pipelines.
Build custom tooling or scripts.

Compare methods

Feature	Automation Workflow	API method
Interface	Dashboard GUI	API calls
Best for	One-off moves	Automation and bulk operations
Technical skill	No coding required	API or scripting knowledge required
Validation	Built into the workflow	Run with simulate mode
Progress monitoring	Workflow UI	Get Network Move API
Error reporting	Messages in the workflow UI	JSON error responses
Audit trail	Automation execution logs	API logs and Organization Change Log
Bulk operations	One network at a time	Script multiple moves

Verify a successful network move

After the move completes, check the following:

Organization Change Log: Check both the source and destination organizations under Organization > Monitor > Change Log.
Device status: Confirm that devices appear online in the destination organization under Network-wide > Monitor > Clients.
Configuration: Spot-check key settings, including VLANs and subnets, SSID configurations, firewall rules, and switch port configurations.
Client connectivity: Confirm that clients can connect to wireless networks and reach required resources.
Licensing: Verify that devices are properly licensed in the destination organization under Organization > Licenses.

Post-move action required: If the network used VPN before the move, reconfigure it as a third-party VPN peer to maintain connectivity with the original organization. See VPN reconfiguration.

FAQ

What happens to device operation during or after a network move?

During the move, devices are moved with their network so device-specific configuration is preserved. There may be a brief disruption while the move is running.

Auto VPN works only for Meraki security appliances in the same dashboard organization. If you move a Meraki MX appliance that acts as an Auto VPN peer to a new organization, reconfigure it as a third-party VPN peer to keep connectivity to devices in the original organization. Use Configuring Site-to-site VPN between MX Appliances in Different Organizations as a reference.

Unexpected downtime can occur if other networks depend on the network being moved. For example, moving a Meraki MX security appliance network to a new organization can cause issues if it acts as a VPN concentrator for a Meraki MR access point network in the original organization. Review dependencies before moving a network.

What is not copied between the original and new organizations?

Meraki security policy does not allow organization-level information to be copied into destination organizations during a network move. The move operation can move devices to an existing organization, but it does not transfer licenses between organizations. Reapply or validate licensing after the move is complete.

By default, recorded video in Meraki MV smart camera networks is lost when you migrate to a new organization. Historical data, including event logs and change log entries for the network and its devices, does not transfer during the move.

Organization-level settings that are not moved:

Network administrators and admin permissions
Licenses
Organization-wide policies and policy objects
Alert settings and notification rules
SAML and SSO configurations
API keys
Integrations such as webhooks and SIEM

Can network portability move networks to an organization in a different global region?

No. The destination organization must be on the same shard and dashboard domain as the source organization. Supported domains are:

meraki.com (North America, South America, Europe, Asia-Pacific)
meraki.cn (China)
meraki.ca (Canada)
meraki.in (India)

You can link multiple organizations in the same region under a single login by using the same username and password when creating a new organization.

How long does a network move take?

Most network moves complete in less than 20 minutes after they start processing. Timing depends on:

The number of devices in the network
The complexity of the configuration
The number of moves queued ahead of yours
Current system load

Network moves are queued and run sequentially. Use the Get Network Move API with your move ID to monitor progress.

Can I move multiple networks at once?

Yes. You can start multiple network move operations. Each request is queued and run sequentially in the order received. Use a separate API call for each network move and keep each move ID so you can monitor them independently.

Glossary

Term	Definition
Organization-wide	Configuration or resources that exist at the organization level and are shared across multiple networks in that organization.
VRF (Virtual Routing and Forwarding)	Network segmentation that creates separate routing tables within the same organization for traffic isolation.
ECO (Extra Config Option)	Advanced configuration option enabled by Meraki support for specific use cases outside standard Dashboard functionality.
Policy object/group	Reusable definition of IP addresses, domains, or ports that can be referenced in firewall rules.
Shard	A geographically distributed cluster of Dashboard infrastructure. Organizations on the same shard can move networks between them. Organizations on different shards cannot, except through Early Access functionality.
PDL (Per Device Licensing)	Licensing model where each device has an individual license assigned to it.
Co-Term	Legacy licensing model where all licenses in an organization share one expiration date.
Subscription Licensing	Licensing model where networks are bound to subscription-based licenses with flexible terms.
Monitor-only mode	Device management mode where the device is managed outside Dashboard but still sends monitoring data for visibility.
XDR (Extended Detection and Response)	Security integration that provides threat detection and response capabilities across the organization.