Quartz 5

Looker Studio Enterprise Service Account Migration Guide

Properties1
tagsplaybook--serve--credentials--bigquery

3 min read

Looker Studio Enterprise Service Account Migration Guide

🧠 Why Personal Credentials Fail (The Crash Mechanism)

By default, Looker Studio uses individual user credentials (OAuth 2.0 authorization) to connect reports to BigQuery. While this is simple for small-scale projects, it is a major architectural anti-pattern for enterprise-level deployments.

When you mix owner accounts (e.g., [email protected] and [email protected]):

  1. OAuth Desynchronization: Any password change, session timeout, security policy shift, or cookie expiration instantly invalidates the connection token.
  2. Multi-Account Browser Conflict: Looker Studio tries to resolve metadata schemas for both accounts simultaneously in the same browser session. If one account fails to authenticate, the entire Looker Studio UI throws a fatal error (Data Studio has encountered a system error) and locks you out completely, preventing even the creation of blank reports.

🛡️ The Permanent Enterprise Solution: Service Account Authentication

To make this dashboard bulletproof and ensure this issue never happens again, we have shifted the connection to an enterprise-grade authentication model: a secure, dedicated Google Cloud Service Account.

Instead of relying on personal browser cookies, Looker Studio now authenticates directly at the project level using a backend service account.

  • Zero Session Dependence: It does not care which user is logged in, whether their passwords changed, or if browser profiles are switched.
  • Stable Connections: OAuth token expirations are entirely bypassed.
  • Role-Based Access Control: Highly secure and conforms to GCP security standards.

We have successfully provisioned and authorized this service account in your GCP console:

  • Service Account Email: looker-studio-sa@thedogwizard-kpi-dashboards.iam.gserviceaccount.com
  • Looker Studio Service Agent Authorized: service-org-259948277585@gcp-sa-datastudio.iam.gserviceaccount.com

🛠️ Step-by-Step Migration Guide (Apply in 60 Seconds)

You do not need to recreate your charts or reconnect the tables. You only need to update the credential type in your existing data sources.

Step 1: Open the Report

Open your Looker Studio report (use a clean browser tab or Chrome profile if your current session is still locked).

Step 2: Manage Data Sources

  1. In the top menu, select Resource > Manage added data sources.
  2. Locate your BigQuery data source and click Edit.

Step 3: Switch Credentials

  1. At the top of the schema definition page, click on Data Credentials.
  2. Change the credential option from Owner’s Credentials or Viewer’s Credentials to Service Account Credentials.
  3. Enter the dedicated Service Account Email: looker-studio-sa@thedogwizard-kpi-dashboards.iam.gserviceaccount.com
  4. Click Update to save the changes, then click Done in the top right.

Step 4: Repeat for Other BigQuery Sources

Repeat the step above for any other BigQuery data sources connected to the report.

🚀 Benefits Achieved

  • Permanent Resolution: No more “Couldn’t save the file” or “System error” crashes caused by browser session mismatch or token expirations.
  • Team Continuity: Any developer or client editor can now access the reports and edit them without breaking backend connection tokens.
  • GCP Security Compliance: Fully auditable connection utilizing the Principle of Least Privilege.

Graph View

Backlinks