Hi @JeffFlowers , in this scenario when you check the larger list of Organizational Policies (the page from the final screenshot), do you see a similarly-named one called iam.disableServiceAccountKeyCreation? 

When I look at your screenshot, the policy that is being highlighted in the error on the first screen is actually this policy (the one I highlight in bold above) rather than the similarly-named one called iam.managed.disableServiceAccountKeyCreation which definitely looks disabled just like you pointed out.

Can you take another look in the Organization Policies and verify that the exact policy mentioned in the error is also disabled?

Was this solved? If so, it would be helpful if you marked the answer 🙂 

Thanks!