Hi @Retired_mod 

we are already using custom VPC but the service account used is the the default compute engine. Expectation from our security team would be that when deploying the workspace a new SA is created in the project with required rights and not using the default compute engine SA.