#Step 2: Turn off Policies and Create a Service Account

To create the service account, first make sure your organization has turned off the policies that disable service account creation. Note the following:

#Turn off the Policies that Disable Service Account Creation

Before creating a service account, make sure the Disable service account creation, Disable service account key creation, and Disable service account key upload policies are turned off. You can refer to the steps below to turn off the policies:

1. If you are required to have the Organization Policy Administrator role to Manage policy, refer to the instructions below to add the Organization Policy Administrator role:

   

   1. Go to .

   2. In the resource list, select the organization of the project where you want to create the service account.

      

   3. Refer to the following instructions based on your scenario:

      • If you want to add a new principal, click Grant access. In the panel of granting access, enter your account in the New principals field, select the Organization Policy Administrator role from the Role drop-down list, and click Save.

        

      • If you want to edit an existing principal, click the Edit principal () button next to the principal. In the panel of editing access, click Add another role, select the Organization Policy Administrator role from the Role drop-down list, and click Save.

        

2. Go to .

3. In the resource list, select the project where you create the service account.

   

4. From Disable service account creation, Disable service account key creation, and Disable service account key upload policies, click the policy that you want to turn off.

   

5. After you click a policy, the policy details page appears, and you can follow the steps below to turn off a policy:

   1. Click Manage policy.

   2. Select Override parent's policy to set a unique policy for this project.

      

   3. Click Add a rule to add a new rule.

      ![Clicking "Add a rule".](/en/getting-started/google/configure-custom-google-app-profiles-recommended/create-a-custom-google-app/images/image66.png "Clicking "Add a rule".")

   4. Select Off to disable the enforcement of the new rule, and click Done.

      

   5. Click Set policy.

#Create a Service Account

Refer to the steps below to create a service account and a client ID:

1. Go to the .

2. Navigate to APIs & Services > Credentials.

3. Click Create credentials and select Service account.

   

4. Enter a service account name and a service account ID. Then, click Done.

   

5. Click the service account, and then click the Keys tab.

6. Click Add Key, and then click Create new key.

   

7. Select the JSON key type and click Create. The downloaded file contains important information for the configuration in the following steps, and you must store the file securely as it can’t be recovered if lost.