Thank you for joining the Google Developer Program forums! In the event you did not know, I do want to also share that there is a Google Workspace Admin Help Community as well: Google Workspace Admin Help
I’ve been trying to solve this problem for the last 10 hours. I contacted the Google Workspace team, but they referred me to Google Cloud because they said it wasn’t their issue.
Give this a try. Since you’ve mentioned the self-service “Request Role” flow is failing, you need to use the “Grant Access” override via the Google Cloud Console. Follow these steps precisely:
Log in as the Super Admin: Ensure you are logged in specifically as the account you mentioned (the one with Super Admin rights in Workspace).
Navigate to Identity & Organisation: Go to the Identity & Organisation page in the GCP Console.
The “Set Permissions” Banner: Because you are a Super Admin but don’t have IAM roles yet, you should see a banner at the top of the page that says something like: “You are a Super Admin of the Google Workspace account for this organisation. You can grant yourself access to the organisation.”
Click “Grant”: Clicking this will programmatically assign you the roles/resourcemanager.organizationAdmin and roles/iam.securityAdmin roles.
Wait for Propagation: It can take a few minutes for these IAM changes to propagate across the global resource manager.
Thanks. We tested this carefully as the Workspace Super Admin (jm.orna@ornaconsultores.com) on organization ornaconsultores.com / Org ID 27386218897.
The organization is visible in the Google Cloud Console, but there is no “Grant yourself access” / “Set permissions” / bootstrap override banner.
On the IAM page for the organization, the console shows: “You need additional access to organization: (URL Removed by Staff)…”
and the missing permission is: resourcemanager.organizations.getIamPolicy
So, in our case, the documented/general expectation that the Workspace Super Admin can bootstrap org IAM by self-service is not materializing in the console UI. This appears to remain a Google Cloud organization bootstrap deadlock: the org exists, there is no Organization Administrator assigned, and the only Workspace Super Admin cannot recover org IAM via self-service.
At this point, we likely need Google internal escalation / manual recovery for org (PII Removed by Staff)
I solved it by going to the organization’s IAM and admin > Identity and organization and then following the button Go to the checklist and then started one of the three plan options, then there should be a popup underneath saying that your account has been given the organization administrator role at current time. From there you can open the IAM page and give yourself an Owner role.
Activate cloud shell ( top right corner icon ) and as super admin, execute command pasted above. Even tho you have dead lock, you should be able to assign such permissions. Wait a little bit for permission propagation and refresh console.
We tested the approach by signing into Google Cloud as the Workspace super admin and running the org-level IAM binding through Cloud Shell. It worked: the super admin was able to assign roles/resourcemanager.organizationAdmin to himself on our organization, and the role is now active and verified in the IAM policy.
So the issue was indeed a bootstrap deadlock / incomplete org initialization state, not a permanent hard block. Your CLI path allowed us to break it without waiting for further escalation.
This is a big step forward for us, because now we can move on to the actual policy issue that was blocking the Gmail webhook setup.
Thanks again for pointing us in the right direction.