Unable to disable the Disable Service Account Key Creation policy

[Dibene]

Good day all, I am having the exact same issue. Can anyone help me? I need to create an JSON account key to Migrate to Microsoft 365.

When I try to disable the Disable Service Account Key Creation policy, I get the below errors

[DamianS]

Hello @Dibene  ,Welcome on Google Cloud Community.

Try to follow via this medium.com post: https://medium.com/google-cloud/troubleshooting-101-solving-the-service-account-key-creation-is-disa...

If your issue will not be resolved, let us know.
--
cheers,
DamianS
LinkedIn medium.com Cloudskillsboost

[Dibene]

Hi Damian

Thank you for getting back to me. I've followed the steps as per your document.
I get all the way to point 5.11 where I need to save the Policy and then I get the same error.

What am I doing wrong?

[DamianS]

Hi @Dibene ,
may I ask about Organization Policy Administrator role? Did you've assigned this particular role at the Org level, to your principal? Additionally, would you be able to provide logs from Logs Explorer regarding this action? For me it looks like your principal ( email@example.com) which you are using to log in to Google Cloud, does not have sufficient permissions ( Only few predefined roles have such permission e.g Organization Policy Administrator).

--
cheers,
DamianS
LinkedIn medium.com Cloudskillsboost

[Dibene]

Hi Damian, That is what I also suspect, but what I can see is that I have the correct permissions?

Where do I find that Logs you talking about?

[DamianS · Accepted solution]

You have assigned Organization Admin. But you must assign also Organization POLICY Administrator, which is totally different predefined role. 

[Dibene]

Hi Damian, Thank you, I managed to assign Organization Policy Administrator.  They went back to Organization Policies and was able to disable/not enforced the policy Disable Account Key Creation.

Thanks for your help!

[DamianS]

Happy to help @Dibene 😉