> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/gcp/gcp-offensive-security/gcp-privilege-escalation/organization-policy-service.md).

# Organization Policy Service

## orgpolicy.policy.set

{% hint style="warning" %}
Changing organization policies can take a few minutes before the change takes effect
{% endhint %}

* Because Organization Policies enforce constraints on who can do what, an attacker with this permission could lift the policy constraint and then perform the previously constrained action.
* This example shows disabling one of Google's managed policies but an attacker could also create or modify a policy.

{% code overflow="wrap" %}

```shellscript
gcloud org-policies set-policy disableServiceAccountKeyCreation.yaml
```

{% endcode %}

{% code overflow="wrap" %}

```yaml
name: organizations/<ProjectId>/policies/iam.managed.disableServiceAccountKeyCreation
spec:
  rules:
  - enforce: false
```

{% endcode %}