This article is written for Google Workspace Administrators.

To set up a service account, xFanatical Foresight creates a Google Cloud project for you. To do this, the Google account you use in xFanatical Foresight needs the Project Creator role in Google Cloud. If it doesn't, setup stops at the Provisioning step with this message:

Failed to create a Google Cloud project. Permission denied. Ask your Google Cloud Organization Administrator to grant you the Project Creator role in Google Cloud Console.

By default, Google gives every user in your domain the Project Creator role when your organization is first set up in Google Cloud. If you see this message, the role was most likely removed in your organization. Follow the steps below to grant it again.

Demo

Prerequisites

  • A Google account with the Organization Administrator role in Google Cloud, to grant the role. If you don't have it, ask your Google Cloud Organization Administrator to follow these steps for you.
  • The email address of the Google account you use in xFanatical Foresight.

Instructions

  1. Sign in to the Google Cloud console with your Organization Administrator account.
  2. Use the project picker dropdown at the left-top of the page to select your Organization.
  3. Go to the IAM page: Menu (☰) > IAM & Admin > IAM.
  4. On the IAM page, click Grant access.
  5. In the Grant access panel:
    1. Under Add principals, enter the email address of the Google account you use in xFanatical Foresight in New principals.
    2. Under Assign roles, click the Role field, type Project Creator, and select.
  6. Click Save.
  7. Check that the account now appears in the list on the IAM page with the Project Creator role.
  8. Wait a few minutes for the change to take effect.
  9. In xFanatical Foresight, go to Settings > Security > Service Accounts, open the setup, and click Retry on the Provisioning step.

Notes

  • Grant the role on the organization, not on a project. xFanatical Foresight creates a new project, so the role must be in the organization (or a folder) where the project will be created.
  • You might be asked to sign in again. Google treats granting access as a sensitive action.
  • "You don't have permission" on the IAM page means your account doesn't have the Organization Administrator role. Ask your Google Cloud Organization Administrator to grant the project creator role, or to grant you Organization Administrator.
  • "Your organization policy blocked project creation" is a different problem. An organization policy in Google Cloud stops new projects, and your Google Cloud Organization Administrator needs to allow it.
  • After setup, the account also needs access to the project xFanatical Foresight created. Don't remove the roles xFanatical Foresight sets up on it.

Learn More