This article is written for Google Workspace Administrators.
Most service account and Actor issues come from missing Google permission or a Domain Wide Delegation change. Find the error message you see below and follow the instructions. After fixing an issue, click Check health now in Settings > Security > Service accounts, then re-enable any disabled rules on the Rules page.
During Service Account Setup
When you create a service account and see error messages, follow the troubleshooting guide below.
| Error message | Solution |
| You do not have the required Google Workspace admin role. | Ask a Super Admin to assign you an admin role with the Users > Read, Domain Management and Reports privilege. Wait a few minutes, then click Retry. |
| Failed to create a Google Cloud project. Permission denied. | Ask your Google Cloud Organization Administrator to grant you the Project Creator role, then click Retry. |
| Your organization policy blocked project creation / service account creation. | Contact your Google Cloud Organization Administrator to allow it. |
| Your Google account has reached its limit for Google Cloud projects. | Click Open Google Cloud Projects, delete unused projects or request a quota increase, then click Retry. |
| Failed to enable the Identity and Access Management (IAM) API on the project. | Contact your Google Cloud Organization Administrator. |
| Token Creator role permissions have not propagated yet. | Wait a moment, then click Retry. |
| Project creation did not finish in time / Provisioning appears to be stalled / The service account is still being set up. | Click Retry. Your progress is saved. |
| Additional permissions are required. | Click Connect with Google and grant the requested permissions. |
| The Domain-wide Delegation for this service account is not ready yet. | If you just made changes in Google Admin Console, wait a few minutes and try again. If it still fails, check the Client ID and scopes in the Domain Wide Delegation step. |
| The permissions you added in Google Admin haven't taken effect yet. | Wait a few minutes and try again. |
Service Account Status Needs Attention
After you set up a service account or later, if its status shows Unauthorized, Disabled or Deleted, follow the troubleshooting guide below.
| Error Message | Solution |
| Your Google account connection, which the service account needs to function, was lost. | Open the Permissions tab and click Connect with Google. |
| Domain-wide Delegation isn't set up correctly in your Google Admin console. | In the Google Admin Console, check that the Client ID and all OAuth scopes match with the Client ID and required permissions in the Domain wide Delegation tab. See Domain Wide Delegation Setup for Service Account. |
| Your Google account lost the Service Account Token Creator role on this service account in Google Cloud IAM. | Ask your Google Cloud Organization Administrator to grant the Service Account Token Creator role to your Google account on the service account again. |
| Your Google Cloud permissions were revoked. | Ask your Google Cloud Organization Administrator to restore your access to the GCP project created by xFanatical Foresight. |
| The service account has been disabled. | Re-enable the service account in Google Cloud Console, or contact Google Cloud Support. |
| The Google Cloud project / service account has been deleted. | Delete the service account, then set up a new service account. |
Actor Field Errors
If you are setting up a rule and notice the Actor field has errors, follow this troubleshooting guide.
| Error Message | Solution |
| Select yourself as the Actor, or set up a service account to continue | Set up a service account in Settings > Security. Save your rule first, because unsaved changes are lost when you leave. |
| Enable the service account to continue | Click Enable Service Account. |
| Grant the required permissions to the service account to continue | Follow the popover instructions. See Grant Permissions to Service Account. |
| Your account lost its Service Account Token Creator role. | Click Go to Google Cloud, restore the Google Cloud Token Creator role, then click Retry. |
| Connect your Google account to continue | Click Connect with Google and grant the requested permissions. |
| The required Google account connection has been lost. | Click Go to Settings and reconnect your Google account. |
| This rule requires your attention because your Google account's access to the linked Google Cloud project was lost. | Ask your Google Cloud administrator to restore your access to the project, then click Retry. |
| This rule requires your attention because the access to the service account in Google Cloud IAM was lost. | Restore your access to the service account in Google Cloud IAM, then click Retry. |
| Insufficient Google Cloud Project permission. | Ask your Google Cloud Organization Administrator to restore your role on the project. |
When Saving the Rule
| Error Message | Solution |
| The selected user does not belong to your Google Workspace organization. | Select a user or a variable that holds the user's primary email in your Google Workspace organization. |
| The Actor field must be a valid email | Select a user from the list, or a variable that holds an email address. |
| Can't save the rule because the Actor field is invalid. | Clear the Actor field, choose the actor again, then save. |
Failed Automations
If you notice or are notified (by email or in-app) that an automation failed or a rule was disabled, follow the troubleshooting guide below.
| Error Message | Solution |
| the user account for the Actor field does not exist / is suspended / is archived in your Google Workspace organization | Select an active user as the Actor, or reactivate the suspended user, or unarchive the archived user in Google Admin Console. |
| the Actor field is missing / the selected Actor field is not a valid email address | Go to the Rules page, edit the rule, and check that the variable holds the user's primary email address. |
| the service account is missing required permissions | Grant the missing permissions through Domain Wide Delegation. |
| the service account is disabled / not set up / has been deleted | Enable Service Account, or Set up a service account |
| Can't trigger the automation because the associated service account is not ready for use | Fix the issue shown in Settings > Security, then try again. |
| the selected user for the Actor field is outside your Google Workspace organization. | Select a user in your organization. |
| Too many requests; try again later / can't verify the user in the Actor field. | Temporary. Run the rule again later. |
If None of Above Works
If you have followed the instructions above but still encounter the issue, contact xFanatical Support for help.
xFanatical Foresight Login
