diff --git a/cmd/climc/shell/compute/secgroups.go b/cmd/climc/shell/compute/secgroups.go
index f1c74f50fb..6f2e8ad229 100644
--- a/cmd/climc/shell/compute/secgroups.go
+++ b/cmd/climc/shell/compute/secgroups.go
@@ -34,4 +34,5 @@ func init() {
 	cmd.Perform("cache-secgroup", &options.SecurityGroupCacheOptions{})
 	cmd.Perform("uncache-secgroup", &options.SecurityGroupUncacheSecurityGroup{})
 	cmd.Perform("purge", &options.SecgroupIdOptions{})
+	cmd.Perform("change-owner", &options.SecgroupChangeOwnerOptions{})
 }
diff --git a/pkg/cloudcommon/db/domainresource.go b/pkg/cloudcommon/db/domainresource.go
index a094f742e9..8e70a56f81 100644
--- a/pkg/cloudcommon/db/domainresource.go
+++ b/pkg/cloudcommon/db/domainresource.go
@@ -201,6 +201,9 @@ func (model *SDomainLevelResourceBase) PerformChangeOwner(ctx context.Context, u
 		}
 	}
 
+	// cancel usage
+	model.cleanModelUsages(ctx, userCred)
+
 	_, err = Update(model, func() error {
 		model.DomainId = ownerId.GetProjectDomainId()
 		model.DomainSrc = string(apis.OWNER_SOURCE_LOCAL)
@@ -210,6 +213,9 @@ func (model *SDomainLevelResourceBase) PerformChangeOwner(ctx context.Context, u
 		return nil, errors.Wrap(err, "Update")
 	}
 
+	// add usage
+	model.RecoverUsages(ctx, userCred)
+
 	OpsLog.SyncOwner(model, former, userCred)
 	notes := struct {
 		OldDomainId string
diff --git a/pkg/cloudcommon/db/modelbase.go b/pkg/cloudcommon/db/modelbase.go
index 010a5c5631..03ea129ddf 100644
--- a/pkg/cloudcommon/db/modelbase.go
+++ b/pkg/cloudcommon/db/modelbase.go
@@ -548,17 +548,24 @@ func (model *SModelBase) CustomizeDelete(ctx context.Context, userCred mcclient.
 	return nil
 }
 
-func cleanModelUsages(ctx context.Context, userCred mcclient.TokenCredential, model IModel) {
+func (model *SModelBase) cleanModelUsages(ctx context.Context, userCred mcclient.TokenCredential) {
 	usages := model.GetIModel().GetUsages()
 	if CancelUsages != nil && len(usages) > 0 {
 		CancelUsages(ctx, userCred, usages)
 	}
 }
 
+func (model *SModelBase) RecoverUsages(ctx context.Context, userCred mcclient.TokenCredential) {
+	usages := model.GetIModel().GetUsages()
+	if AddUsages != nil && len(usages) > 0 {
+		AddUsages(ctx, userCred, usages)
+	}
+}
+
 func (model *SModelBase) PreDelete(ctx context.Context, userCred mcclient.TokenCredential) {
 	// clean usage on predelete
 	// clean usage before fakedelete for pending delete models
-	cleanModelUsages(ctx, userCred, model)
+	model.cleanModelUsages(ctx, userCred)
 }
 
 func (model *SModelBase) PostDelete(ctx context.Context, userCred mcclient.TokenCredential) {
diff --git a/pkg/cloudcommon/db/virtualresource.go b/pkg/cloudcommon/db/virtualresource.go
index 2341d9dbda..d54276e76b 100644
--- a/pkg/cloudcommon/db/virtualresource.go
+++ b/pkg/cloudcommon/db/virtualresource.go
@@ -379,6 +379,9 @@ func (model *SVirtualResourceBase) PerformChangeOwner(ctx context.Context, userC
 		}
 	}
 
+	// cancel usage
+	model.cleanModelUsages(ctx, userCred)
+
 	_, err = Update(model, func() error {
 		model.DomainId = ownerId.GetProjectDomainId()
 		model.ProjectId = ownerId.GetProjectId()
@@ -389,6 +392,9 @@ func (model *SVirtualResourceBase) PerformChangeOwner(ctx context.Context, userC
 		return nil, errors.Wrap(err, "Update")
 	}
 
+	// add usage
+	model.RecoverUsages(ctx, userCred)
+
 	OpsLog.SyncOwner(model, former, userCred)
 	notes := struct {
 		OldProjectId string
@@ -456,13 +462,6 @@ func (model *SVirtualResourceBase) PerformCancelDelete(ctx context.Context, user
 	return nil, nil
 }
 
-func (model *SVirtualResourceBase) RecoverUsages(ctx context.Context, userCred mcclient.TokenCredential) {
-	usages := model.GetIModel().GetUsages()
-	if AddUsages != nil && len(usages) > 0 {
-		AddUsages(ctx, userCred, usages)
-	}
-}
-
 func (model *SVirtualResourceBase) DoCancelPendingDelete(ctx context.Context, userCred mcclient.TokenCredential) error {
 	err := model.CancelPendingDelete(ctx, userCred)
 	if err == nil {
diff --git a/pkg/mcclient/modules/mod_secgroups.go b/pkg/mcclient/modules/mod_secgroups.go
index e11e5b1b9a..cb25dfab60 100644
--- a/pkg/mcclient/modules/mod_secgroups.go
+++ b/pkg/mcclient/modules/mod_secgroups.go
@@ -23,7 +23,7 @@ var (
 func init() {
 	SecGroups = NewComputeManager("secgroup", "secgroups",
 		[]string{"ID", "Name", "Rules",
-			"Is_public", "Created_at",
+			"Is_public", "Created_at", "Tenant_Id", "Tenant",
 			"Guest_cnt", "Description", "in_rules", "out_rules"},
 		[]string{})
 
diff --git a/pkg/mcclient/options/secgroup.go b/pkg/mcclient/options/secgroup.go
index f4a9a2ba51..80ff156b25 100644
--- a/pkg/mcclient/options/secgroup.go
+++ b/pkg/mcclient/options/secgroup.go
@@ -18,6 +18,8 @@ import (
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/secrules"
+
+	"yunion.io/x/onecloud/pkg/apis"
 )
 
 type SecgroupListOptions struct {
@@ -118,3 +120,8 @@ func (opts *SecurityGroupUncacheSecurityGroup) Params() (jsonutils.JSONObject, e
 	params.Remove("id")
 	return params, nil
 }
+
+type SecgroupChangeOwnerOptions struct {
+	SecgroupIdOptions
+	apis.ProjectizedResourceInput
+}