Unable to find GCP Organization Policies in Prisma Cloud

Symptoms

• A newly onboarded or secondary GCP organization shows a Green health status in the Prisma Cloud dashboard.

• Some GCP cloud assets are visible and successfully ingested post-onboarding.

• GCP Organization Policies are entirely missing or cannot be found within Prisma Cloud.

• Product: Prisma Cloud

• Cloud Provider: Google Cloud Platform (GCP)

• Components: GCP Organization onboarding, GCP Service Account, GCP APIs, IAM Roles

The "Green" status indicates successful basic API connectivity and ingestion for general resources.

However, fetching metadata for GCP Organization Policies requires specific organization-level permissions and API access.

If these granular roles are missing or if the necessary APIs are disabled in the host project, the background ingestion for policies will fail without necessarily degrading the overall health status to "Red" in the dashboard.

To resolve this issue, you must ensure the correct API enablement and grant organization-level permissions to the Prisma Cloud Service Account.

1. Enable Required GCP APIs

Ensure the following APIs are explicitly enabled in the GCP host project where the Prisma Cloud Service Account resides:

• cloudasset.googleapis.com (Cloud Asset API)

• cloudresourcemanager.googleapis.com (Cloud Resource Manager API)

• iam.googleapis.com (Identity and Access Management (IAM) API)

2. Assign IAM Roles at the Organization Level

The service account requires visibility across the entire hierarchy. Grant the Prisma Cloud Service Account the following IAM roles at the GCP Organization Level (not just at the individual project level):

• roles/cloudasset.viewer (Cloud Asset Viewer)

• roles/resourcemanager.organizationViewer (Organization Viewer)

• roles/browser (Browser)

3. Check Domain Restricted Sharing Constraints

If organization policies still fail to appear after completing Steps 1 and 2, verify your organization's security policies:

• Review your GCP organization's Domain Restricted Sharing constraints (constraints/iam.allowedPolicyMemberDomains).

• If active, ensure they are adjusted to whitelist or allow the Prisma Cloud service account identity to prevent cross-domain blocking.

4. Validation Steps

5. Log in to the Google Cloud Console and navigate to the IAM & Admin page at the Organization level to verify the three roles are actively bound to the Prisma Cloud service account identity.

6. Allow time for the next Prisma Cloud discovery/ingestion cycle to run.

7. Log in to the Prisma Cloud Console and verify that the GCP Organization Policies are now populated and searchable within the asset inventory or policy compliance sections.

• Enabling an API in your Google Cloud project documentation here
• IAM roles and permissions index documentation here
• Access control for organization resources with IAM here