Grant discovery access to a service agent

This page describes how to grant the required role to a service agent so that it can be used to profile data at the organization or folder level.

Perform these tasks if both of the following conditions apply:

• You created a scan configuration at the organization or folder level.

• Sensitive Data Protection isn't generating any data profiles for the scan configuration. When you view configuration errors, you see the following error message:

  None of the driver projects (PROJECT_ID) have MISSING_PERMISSION
  permission for organizations/ORGANIZATION_ID.

Get the ID of the service agent

Get the service agent ID that is associated with your scan configuration:

1. Go to the discovery scan configurations list.

   Go to discovery scan configurations

2. On the toolbar, select your organization.
3. Select your scan configuration.
4. On the Scan configuration details page, copy the value of the Service agent field. The service agent ID is in the format of an email address.

Give your service agent ID to a Google Cloud administrator, who must then grant data profiling access to the service agent.

Grant data profiling access

This section describes how to grant access to a service agent so that it can be used to profile data at the organization or folder level.

Only someone who has the permissions to grant IAM roles to a service agent, such as a Google Cloud administrator, can perform these steps.

To complete these steps, you need the ID of the service agent that you want to grant data profiling access to.

To grant data profiling access at the organization or folder level, follow these steps:

1. In the Google Cloud console, go to the IAM page.

   Go to IAM

2. On the toolbar, select your organization.

3. Click Grant access.

4. In the New principals field, enter the service agent ID.

5. In the Select a role field, enter and select DLP Organization Data Profiles Driver.

6. Click Save.