Greetings @borft ,  It sounds like you’re being redirected into a workspace without the right privileges; let’s get you into the correct Databricks account console for your GCP Marketplace subscription and identify the right login.

What login is required (and why)

• You must be a Databricks account admin to update the new GCE compute permissions; this can be done in the account console with “Update permissions” or via the Accounts API if your org uses a provisioning service account.
• For GCP Marketplace (PAYG), the person who completed “Register with Databricks / Manage on Provider” during subscription became the initial Databricks account owner for that billing account; they log into the account console at https://accounts.gcp.databricks.com using their Google identity.

How to identify the right Google account to log in

• Identify the Google Cloud billing account tied to your Databricks workspace’s project, then check Cloud Marketplace “Your orders” for Databricks under that billing account. Workspaces are provisioned into a customer GCP project you specify at workspace creation, so the project’s Billing page will show the billing account to inspect in Marketplace.
• In Google Cloud Console > Cloud Marketplace > Your orders (for the correct billing account), ensure the Databricks order is Active, then click the blue Manage on Provider button; this opens the Databricks account console for that subscription and is the most reliable entry point.
• If you’re being bounced into a workspace by SSO, use an incognito window and go directly to the account console: https://accounts.gcp.databricks.com/. If you know the Databricks Account ID, you can force the account login with a hint: https://accounts.gcp.databricks.com/login?account_id=<account-id>.
• If none of your current billing admins can access the account console for that subscription (common when a predecessor subscribed), ask the original marketplace procurement/billing admin to add you as an account admin in the Databricks account console. If you truly have no one with console access, contact supportops@databricks.com with your Google order number and billing account details and your Databricks account team; they can help locate and restore access.
• Tip: if you do have account console access, you can match the subscription to its Google order number in Settings > Subscription & Billing, then cross-check it in the Marketplace listing to confirm the exact billing account owning the subscription.

Once you’re in the account console, update the GCE permissions

• Use the UI: In the account console, click Update permissions, confirm you have sufficient GCP privileges on the workspace projects, and proceed. This is for account owners who themselves have permissions on those projects.
• Use the Accounts API if your org manages provisioning via a service account. Authenticate with:

  • X-Databricks-GCP-SA-Access-Token (Google OAuth 2.0 access token for a SA that can impersonate the Databricks-managed GCP SA)
  • Authorization: Bearer (Databricks account-level access token with sufficient privileges)
  Then call: bash curl --location --request PATCH "https://accounts.gcp.databricks.com/api/2.0/accounts/<account-id>/migrateToComputeOnGce" \ --header "X-Databricks-GCP-SA-Access-Token: $ACCESS_TOKEN" \ --header "Authorization: Bearer $AUTH_TOKEN"

Edge cases you may need to handle

• If you use a customer-managed VPC, the update attempts to add a firewall rule automatically; if it fails, add this rule manually (permits only intra‑VPC Databricks traffic): Rule name: databricks-{WORKSPACE_ID}-ingress; Direction: Ingress; Priority: 1000; Targets: Network tag databricks-{WORKSPACE_ID}; Source: primary CIDR of subnet; Protocols/ports: Allow all.
• If you enforce GCP org policies for trusted images, add projects/databricks-external-images to your trusted image policy (constraints/compute.trustedImageProjects) so compute can launch.
• To test GCE migration after updating, tag a new compute resource with key x-databricks-nextgen-cluster, value true; it should display a GCE label once running.

Why you were landing in a workspace

• The account console (accounts.gcp.databricks.com) is distinct from a workspace UI; Marketplace flows route you to the account console via Register/Manage on Provider, but it’s common for users to inadvertently sign into a workspace where they lack account-admin privileges.

Hope this helps, Louis.