Manage user access with Marketplace User Access Restrictions
Stay organized with collections
Save and categorize content based on your preferences.
By default, any user with the Identity and Access Management (IAM) permission
resourcemanager.projects.get for a Google Cloud project can access
Google Cloud Marketplace to discover new products. If you want to enforce stricter
governance and procurement policies in your Google Cloud organization,
you can use Marketplace User Access Restrictions to require that users have
additional IAM permissions to accomplish some tasks.
Required IAM permissions
After you turn on Marketplace User Access Restrictions, your organization's users
must have the following IAM permissions to complete the following
tasks:
Action
IAM Roles
Level at which role is assigned
Enable Marketplace User Access Restrictions
Organization Administrator (roles/resourcemanager.organizationAdmin) AND
Commerce Organization Governance Admin (roles/commerceorggovernance.admin) roles
Organization level
Interacting with products listed on the Google Cloud Marketplace
Governed Marketplace User (roles/commerceorggovernance.user) role
When Cloud Marketplace User Access Restrictions is turned on for your
organization, you must have these IAM permissions to do the
following:
commerceorggovernance.services.list lets you view and interact with the
Google Cloud Private Marketplace homepage.
commerceorggovernance.services.get lets you interact with product listing
pages.
If Request Product is
turned on, commerceorggovernance.services.request and
consumerprocurement.entitlements.list let you request unapproved products
or products that haven't been procured.
Before you begin
Ensure you have sufficient roles to enable Marketplace User Access Restrictions. You can find the required details listed above.
Ensure users and administrators in your organization that require access to the Marketplace are given sufficient roles. You can find the required roles listed above.
Verify that Google Cloud Private Marketplace supports the products that you plan to use. For a
list of supported products, see
Supported products.
Turn on Marketplace User Access Restrictions
By default, Marketplace User Access Restrictions is turned off for your organization.
After you've assigned the above IAM roles to relevant users and administrators in your organization, to turn this feature on, complete the following steps:
In Cloud Marketplace, click Marketplace Governance.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[],[],null,["# Manage user access with Marketplace User Access Restrictions\n\nBy default, any user with the Identity and Access Management (IAM) permission\n`resourcemanager.projects.get` for a Google Cloud project can access\nGoogle Cloud Marketplace to discover new products. If you want to enforce stricter\ngovernance and procurement policies in your Google Cloud organization,\nyou can use Marketplace User Access Restrictions to require that users have\nadditional IAM permissions to accomplish some tasks.\n\nRequired IAM permissions\n------------------------\n\nAfter you turn on Marketplace User Access Restrictions, your organization's users\nmust have the following IAM permissions to complete the following\ntasks:\n\nThe\n[Governed Marketplace User](/marketplace/docs/access-control#commerceorggovernance.user)\nIAM role contains the following IAM permissions:\n\n- `commerceorggovernance.services.get`\n- `commerceorggovernance.services.list`\n- `commerceorggovernance.services.request`\n- `resourcemanager.projects.get`\n- `consumerprocurement.entitlements.list`\n\nWhen Cloud Marketplace User Access Restrictions is turned on for your\norganization, you must have these IAM permissions to do the\nfollowing:\n\n- `commerceorggovernance.services.list` lets you view and interact with the Google Cloud Private Marketplace homepage.\n- `commerceorggovernance.services.get` lets you interact with product listing pages.\n- If [Request Product](/marketplace/docs/governance/product-requests) is turned on, `commerceorggovernance.services.request` and `consumerprocurement.entitlements.list` let you request unapproved products or products that haven't been procured.\n\n| **Caution:** Ensure that key billing, organization, and project administrators have these roles assigned to them to not disrupt their associated Cloud Marketplace experience.\n\nBefore you begin\n----------------\n\n1. Ensure you have sufficient roles to enable Marketplace User Access Restrictions. You can find the required details listed [above](#required-permissions).\n\n2. Ensure users and administrators in your organization that require access to the Marketplace are given sufficient roles. You can find the required roles listed [above](#required-permissions).\n\n3. Verify that Google Cloud Private Marketplace supports the products that you plan to use. For a\n list of supported products, see\n [Supported products](/marketplace/docs/governance/private-marketplace#supported-products).\n\nTurn on Marketplace User Access Restrictions\n--------------------------------------------\n\nBy default, Marketplace User Access Restrictions is turned off for your organization.\n\nAfter you've assigned the [above IAM roles](#required-permissions) to relevant users and administrators in your organization, to turn this feature on, complete the following steps:\n\n1. In Cloud Marketplace, click **Marketplace Governance**.\n\n [Go to Marketplace](https://console.cloud.google.com/marketplace)\n2. In Governance settings, click the toggle to enable Marketplace User Access Restrictions.\n\n3. Click Confirm in the dialog.\n\n| **Note:** to disable this feature, click the toggle to turn-off enforcement. The experience for all users in your organization will revert to the default Google Cloud Marketplace experience"]]
