How can I invite an external developer to a Firebase project when organization policies restrict external domains?

Below is some guidance based on Firebase and Google Cloud IAM:

1. Why am I missing the orgpolicy.policies.create permission?

Even as an Organization Administrator (and Owner), the ability to create or update organization policies isn’t automatically granted. The orgpolicy.policies.create permission is part of a more specific role (for example, the Organization Policy Administrator role) and may not be included in your Organization Administrator privileges. In many organizations the ability to change policies is restricted to a dedicated role to prevent inadvertent policy changes, which is why you received the error.

2. How can I modify the iam.allowedPolicyMemberDomains policy to allow external users?

To change the policy, you need to update it with an account that has the necessary permission (orgpolicy.policies.create). You can do this by:

• Using a Service Account or User with the Correct Role: Request or assign the Organization Policy Administrator role (or another custom role that includes orgpolicy.policies.create) to your account (or use a different account that already has it).
• Making the Change Using the Cloud Console or gcloud: Once you have the correct permission, open the IAM & Admin section in the Cloud console, navigate to Organization Policies, locate the iam.allowedPolicyMemberDomains policy, and update it to include the external domain(s) you want to allow.

For example, if using the gcloud command-line tool, you’d first fetch the policy, update it (or create an override) with the additional domains, and then set it back. (Ensure you have the proper permission on the organization resource.)

3. Is there an alternative approach to invite an external developer in this scenario?

Yes, there are a couple of alternatives you might consider:

• Create a Project-Level Exception: Rather than changing the organization policy, you could assign a project-level IAM role that enables the external developer to work on the project. In the Firebase console, if you add the developer as a project member (via the Users and permissions tab), they may be granted access on just that project without affecting the organization-wide policy.
• Use a Google Group as an Intermediary: You could add the external developer’s account to a Google Group that has been specifically allowed by the organization policy. Then, add that group as a project member. This approach avoids directly adding a non-domain user if the organization policy is intended to restrict individual external accounts.

Summary

• You’re missing orgpolicy.policies.create because that permission is controlled by a dedicated role not automatically granted as part of a standard Organization Administrator.
• To modify the iam.allowedPolicyMemberDomains policy, use an account with the Organization Policy Administrator role (or equivalent custom role) and update the policy via the Cloud console or gcloud.
• Alternatively, consider project-level invitations or using an allowed Google Group so you don’t have to alter the organization-wide policy.

Let me know if you need additional Firebase or IAM-specific details!