diff --git a/internal/provider/resource_group_test.go b/internal/provider/resource_group_test.go
index aeca0ad6..3fa3f211 100644
--- a/internal/provider/resource_group_test.go
+++ b/internal/provider/resource_group_test.go
@@ -19,38 +19,45 @@ const (
 var (
 	orgGroup = fmt.Sprintf(`
 resource "boundary_group" "foo" {
-  name = "test"
+  name        = "test"
 	description = "%s"
+	scope_id    = boundary_organization.foo.id
 }`, fooGroupDescription)
 
 	orgGroupUpdate = fmt.Sprintf(`
 resource "boundary_group" "foo" {
-  name = "test"
+  name        = "test"
 	description = "%s"
+  scope_id    = boundary_organization.foo.id
 }`, fooGroupDescriptionUpdate)
 
 	orgGroupWithMembers = `
 resource "boundary_user" "foo" {
   description = "foo"
+  scope_id    = boundary_organization.foo.id
 }
 
 resource "boundary_group" "with_members" {
 	description = "with members"
 	member_ids  = [boundary_user.foo.id]
+  scope_id    = boundary_organization.foo.id
 }`
 
 	orgGroupWithMembersUpdate = `
 resource "boundary_user" "foo" {
   description = "foo"
+  scope_id    = boundary_organization.foo.id
 }
 
 resource "boundary_user" "bar" {
   description = "bar"
+  scope_id    = boundary_organization.foo.id
 }
 
 resource "boundary_group" "with_members" {
 	description = "with members"
 	member_ids  = [boundary_user.foo.id, boundary_user.bar.id]
+  scope_id    = boundary_organization.foo.id
 }`
 
 	orgToProjectGroupUpdate = fmt.Sprintf(`
@@ -97,26 +104,24 @@ func TestAccGroup(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, orgGroup),
+				Config: testConfig(url, fooOrg, orgGroup),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists("boundary_group.foo"),
 					resource.TestCheckResourceAttr("boundary_group.foo", groupDescriptionKey, fooGroupDescription),
 					resource.TestCheckResourceAttr("boundary_group.foo", groupNameKey, "test"),
-					resource.TestCheckResourceAttr("boundary_group.foo", groupScopeIDKey, tcOrg),
 				),
 			},
 			{
 				// test update
-				Config: testConfig(url, orgGroupUpdate),
+				Config: testConfig(url, fooOrg, orgGroupUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists("boundary_group.foo"),
 					resource.TestCheckResourceAttr("boundary_group.foo", groupDescriptionKey, fooGroupDescriptionUpdate),
-					resource.TestCheckResourceAttr("boundary_group.foo", groupScopeIDKey, tcOrg),
 				),
 			},
 			{
 				// test update to project scope
-				Config: testConfig(url, fooProject, orgToProjectGroupUpdate),
+				Config: testConfig(url, fooOrg, fooProject, orgToProjectGroupUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists("boundary_group.foo"),
 					resource.TestCheckResourceAttr("boundary_group.foo", groupDescriptionKey, fooGroupDescriptionUpdate),
@@ -125,7 +130,7 @@ func TestAccGroup(t *testing.T) {
 			},
 			{
 				// test create
-				Config: testConfig(url, fooProject, projGroup),
+				Config: testConfig(url, fooOrg, fooProject, projGroup),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists("boundary_group.foo"),
 					resource.TestCheckResourceAttr("boundary_group.foo", groupDescriptionKey, fooGroupDescription),
@@ -135,7 +140,7 @@ func TestAccGroup(t *testing.T) {
 			},
 			{
 				// test update
-				Config: testConfig(url, fooProject, projGroupUpdate),
+				Config: testConfig(url, fooOrg, fooProject, projGroupUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists("boundary_group.foo"),
 					resource.TestCheckResourceAttr("boundary_group.foo", groupDescriptionKey, fooGroupDescriptionUpdate),
@@ -144,7 +149,7 @@ func TestAccGroup(t *testing.T) {
 			},
 			{
 				// test update to org scope
-				Config: testConfig(url, fooProject, projToOrgGroupUpdate),
+				Config: testConfig(url, fooOrg, fooProject, projToOrgGroupUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists("boundary_group.foo"),
 					resource.TestCheckResourceAttr("boundary_group.foo", groupDescriptionKey, fooGroupDescriptionUpdate),
@@ -167,7 +172,7 @@ func TestAccGroupWithMembers(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, orgGroupWithMembers),
+				Config: testConfig(url, fooOrg, orgGroupWithMembers),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists("boundary_group.with_members"),
 					testAccCheckGroupResourceExists("boundary_user.foo"),
@@ -177,7 +182,7 @@ func TestAccGroupWithMembers(t *testing.T) {
 			},
 			{
 				// test update
-				Config: testConfig(url, orgGroupWithMembersUpdate),
+				Config: testConfig(url, fooOrg, orgGroupWithMembersUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists("boundary_group.with_members"),
 					testAccCheckGroupResourceExists("boundary_user.foo"),
@@ -318,7 +323,6 @@ func testAccCheckGroupResourceExists(name string) resource.TestCheckFunc {
 
 func testAccCheckGroupResourceDestroy(t *testing.T) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		fmt.Printf("test check group resource destroyed\n")
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
 		}
@@ -327,6 +331,8 @@ func testAccCheckGroupResourceDestroy(t *testing.T) resource.TestCheckFunc {
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
+			case "boundary_organization":
+				continue
 			case "boundary_project":
 				continue
 			case "boundary_user":
diff --git a/internal/provider/resource_role_test.go b/internal/provider/resource_role_test.go
index 584ff456..9cfe505b 100644
--- a/internal/provider/resource_role_test.go
+++ b/internal/provider/resource_role_test.go
@@ -23,12 +23,14 @@ var (
 resource "boundary_role" "foo" {
   name        = "test"
 	description = "%s"
+	scope_id    = boundary_organization.foo.id
 }`, fooRoleDescription)
 
 	orgRoleUpdate = fmt.Sprintf(`
 resource "boundary_role" "foo" {
   name        = "test"
 	description = "%s"
+  scope_id    = boundary_organization.foo.id
 }`, fooRoleDescriptionUpdate)
 
 	ProjToOrgRole = fmt.Sprintf(`
@@ -142,7 +144,7 @@ func TestAccRoleToOrgToProject(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test org role create
-				Config: testConfig(url, orgRole),
+				Config: testConfig(url, fooOrg, orgRole),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists("boundary_role.foo"),
 					resource.TestCheckResourceAttr("boundary_role.foo", "name", "test"),
@@ -151,7 +153,7 @@ func TestAccRoleToOrgToProject(t *testing.T) {
 			},
 			{
 				// test org role update
-				Config: testConfig(url, orgRoleUpdate),
+				Config: testConfig(url, fooOrg, orgRoleUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists("boundary_role.foo"),
 					resource.TestCheckResourceAttr("boundary_role.foo", "name", "test"),
@@ -160,7 +162,7 @@ func TestAccRoleToOrgToProject(t *testing.T) {
 			},
 			{
 				// test org to project role create
-				Config: testConfig(url, fooProject, projRole),
+				Config: testConfig(url, fooOrg, fooProject, projRole),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists("boundary_role.foo"),
 					resource.TestCheckResourceAttr("boundary_role.foo", "name", "test"),
@@ -169,7 +171,7 @@ func TestAccRoleToOrgToProject(t *testing.T) {
 			},
 			{
 				// test project role update
-				Config: testConfig(url, fooProject, projRoleUpdate),
+				Config: testConfig(url, fooOrg, fooProject, projRoleUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists("boundary_role.foo"),
 					resource.TestCheckResourceAttr("boundary_role.foo", "name", "test"),
@@ -191,7 +193,7 @@ func TestAccRoleWithGrants(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test project role create with grants
-				Config: testConfig(url, fooProject, projRoleWithGrants),
+				Config: testConfig(url, fooOrg, fooProject, projRoleWithGrants),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists("boundary_role.with_grants"),
 					testAccCheckRoleResourceGrantsSet("boundary_role.with_grants", []string{readonlyGrant}),
@@ -201,7 +203,7 @@ func TestAccRoleWithGrants(t *testing.T) {
 			},
 			{
 				// test project role update with grants
-				Config: testConfig(url, fooProject, projRoleWithGrantsUpdate),
+				Config: testConfig(url, fooOrg, fooProject, projRoleWithGrantsUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists("boundary_role.with_grants"),
 
@@ -225,7 +227,7 @@ func TestAccRoleWithPrincipals(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooProject, projRoleWithPrincipal),
+				Config: testConfig(url, fooOrg, fooProject, projRoleWithPrincipal),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists("boundary_role.with_principal"),
 					testAccCheckRoleResourcePrincipalsSet("boundary_role.with_principal", []string{"boundary_user.foo"}),
@@ -237,7 +239,7 @@ func TestAccRoleWithPrincipals(t *testing.T) {
 			},
 			{
 				// test update
-				Config: testConfig(url, fooProject, projRoleWithPrincipalUpdate),
+				Config: testConfig(url, fooOrg, fooProject, projRoleWithPrincipalUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists("boundary_role.with_principal"),
 					testAccCheckUserResourceExists("boundary_user.foo"),
@@ -260,7 +262,7 @@ func TestAccRoleWithGroups(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooProject, projRoleWithGroups),
+				Config: testConfig(url, fooOrg, fooProject, projRoleWithGroups),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists("boundary_role.with_groups"),
 					testAccCheckRoleResourceGroupsSet("boundary_role.with_groups", []string{"boundary_group.foo"}),
@@ -272,7 +274,7 @@ func TestAccRoleWithGroups(t *testing.T) {
 			},
 			{
 				// test update
-				Config: testConfig(url, fooProject, projRoleWithGroupsUpdate),
+				Config: testConfig(url, fooOrg, fooProject, projRoleWithGroupsUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists("boundary_role.with_groups"),
 					testAccCheckUserResourceExists("boundary_group.foo"),
diff --git a/internal/provider/resource_user_test.go b/internal/provider/resource_user_test.go
index 3edff491..a7768a18 100644
--- a/internal/provider/resource_user_test.go
+++ b/internal/provider/resource_user_test.go
@@ -20,14 +20,16 @@ const (
 var (
 	orgUser = fmt.Sprintf(`
 resource "boundary_user" "foo" {
-  name = "test"
+  name        = "test"
 	description = "%s"
+  scope_id    = boundary_organization.foo.id
 }`, fooUserDescription)
 
 	orgUserUpdate = fmt.Sprintf(`
 resource "boundary_user" "foo" {
-  name = "test"
+  name        = "test"
 	description = "%s"
+  scope_id    = boundary_organization.foo.id
 }`, fooUserDescriptionUpdate)
 )
 
@@ -42,22 +44,20 @@ func TestAccUser(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, orgUser),
+				Config: testConfig(url, fooOrg, orgUser),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUserResourceExists("boundary_user.foo"),
 					resource.TestCheckResourceAttr("boundary_user.foo", userDescriptionKey, fooUserDescription),
 					resource.TestCheckResourceAttr("boundary_user.foo", userNameKey, "test"),
-					resource.TestCheckResourceAttr("boundary_user.foo", userScopeIDKey, tcOrg),
 				),
 			},
 			{
 				// test update description
-				Config: testConfig(url, orgUserUpdate),
+				Config: testConfig(url, fooOrg, orgUserUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUserResourceExists("boundary_user.foo"),
 					resource.TestCheckResourceAttr("boundary_user.foo", userDescriptionKey, fooUserDescriptionUpdate),
 					resource.TestCheckResourceAttr("boundary_user.foo", userNameKey, "test"),
-					resource.TestCheckResourceAttr("boundary_user.foo", userScopeIDKey, tcOrg),
 				),
 			},
 		},
@@ -114,8 +114,8 @@ func testAccCheckUserResourceDestroy(t *testing.T) resource.TestCheckFunc {
 				usrs := users.NewUsersClient(projClient)
 
 				_, apiErr, _ := usrs.Read(md.ctx, id)
-				if apiErr == nil || apiErr.Status != http.StatusNotFound {
-					return fmt.Errorf("Didn't get a 404 when reading destroyed user %q: %v", id, apiErr)
+				if apiErr == nil || apiErr.Status != http.StatusNotFound && apiErr.Status != http.StatusForbidden {
+					return fmt.Errorf("Didn't get a 404 or 403 when reading destroyed user %q: %v", id, apiErr)
 				}
 
 			default: