Stay organized with collectionsSave and categorize content based on your preferences.
Insights uses per-projectservice accountsto
access resources in the customer project—such as audio and transcript files in your Google Cloud storage bucket—during
analysis. Each project's service account is automatically created the first time you
access any user resources. By default, the service account is
automatically given some default access—such as Google Cloud storage access—to the project.
After you create your first conversation, you should see the service account
permissions in your project's IAM settings. If you accidentally remove or don't see the
service account permissions, then you can manually give it access to the correct permissions. The account
always has the formservice-<project_number>@gcp-sa-contactcenterinsights.iam.gserviceaccount.com.
To change an account's permissions manually, navigate to the IAM panel of the
Insights console and give that user thecontactcenterinsights.serviceAgentpermission. The service account can also be given fine-grained permissions, though too many of these can lead to instability.
If you see an error message like the following, first verify that your Insights service account exists in your IAM configuration.
"message": "IAM permission 'dialogflow.participants.suggest' on 'projects/<project>/locations/global/conversations/fake_conversation_id/participants/fake_participant_id' denied."
Then, make sureInclude Google-provided role grantsis checked:
Audio export
To export audio from Agent Assist or Dialogflow to Insights, verify thatservice-<project_number>@gcp-sa-dialogflow.iam.gserviceaccount.comhas thedialogflow.serviceAgentrole.
Manual service agent creation
You can create the Conversational Insights service agent with the following command:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[[["\u003cp\u003eInsights utilizes per-project service accounts to access customer project resources, such as audio and transcript files in Google Cloud storage.\u003c/p\u003e\n"],["\u003cp\u003eEach project's service account is automatically created upon the first access to any user resource and has default access.\u003c/p\u003e\n"],["\u003cp\u003eService account permissions can be manually adjusted in the project's IAM settings using the contactcenterinsights.serviceAgent permission.\u003c/p\u003e\n"],["\u003cp\u003eThe service accounts follow the following format: service-<project_number>@gcp-sa-contactcenterinsights.iam.gserviceaccount.com.\u003c/p\u003e\n"],["\u003cp\u003eIf encountering an IAM permission error, verify the Insights service account exists and that \u003cstrong\u003eInclude Google-provided role grants\u003c/strong\u003e is checked.\u003c/p\u003e\n"]]],[],null,["# Troubleshooting service account access\n\nInsights uses per-project\n[service accounts](/iam/docs/service-accounts) to\naccess resources in the customer project---such as audio and transcript files in your Google Cloud storage bucket---during\nanalysis. Each project's service account is automatically created the first time you\naccess any user resources. By default, the service account is\nautomatically given some default access---such as Google Cloud storage access---to the project.\n\nAfter you create your first conversation, you should see the service account\npermissions in your project's IAM settings. If you accidentally remove or don't see the\nservice account permissions, then you can manually give it access to the correct permissions. The account\nalways has the form `service-\u003cproject_number\u003e@gcp-sa-contactcenterinsights.iam.gserviceaccount.com`.\n\nTo change an account's permissions manually, navigate to the IAM panel of the\nInsights console and give that user the\n[contactcenterinsights.serviceAgent](/iam/docs/roles-permissions/contactcenterinsights#contactcenterinsights.serviceAgent)\npermission. The service account can also be given fine-grained permissions, though too many of these can lead to instability.\n\nIf you see an error message like the following, first verify that your Insights service account exists in your IAM configuration.\n\n`\"message\": \"IAM permission 'dialogflow.participants.suggest' on 'projects/\u003cproject\u003e/locations/global/conversations/fake_conversation_id/participants/fake_participant_id' denied.\"`\n\nThen, make sure **Include Google-provided role grants** is checked:\n\nAudio export\n------------\n\nTo export audio from Agent Assist or Dialogflow to Insights, verify that `service-\u003cproject_number\u003e@gcp-sa-dialogflow.iam.gserviceaccount.com` has the [dialogflow.serviceAgent](/iam/docs/roles-permissions/dialogflow#dialogflow.serviceAgent) role.\n\nManual service agent creation\n-----------------------------\n\nYou can create the Conversational Insights service agent with the following command: \n\n gcloud beta services identity create --service=contactcenterinsights.googleapis.com --project=\u003cproject_id\u003e"]]
