Enable Audit Manager so that you can audit Google Cloud folders and
projects using built-in or custom frameworks.

## Before you begin

To enable APIs, you need the Service Usage Admin IAM role
(`roles/serviceusage.serviceUsageAdmin`), which contains the
`serviceusage.services.enable` permission. To learn how to grant
roles, see [Manage access to projects, folders, and
organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access).

## Enable Audit Manager

1. If required, update the [Restrict service usage organization policy
   constraint](https://docs.cloud.google.com/organization-policy/restrict-services) to include the
   Audit Manager API (`auditmanager.googleapis.com`).

2. To enable Audit Manager, complete one of the following:

   - To enable Audit Manager on a project, enable the
     Audit Manager API.


     [Go to Enable access to API](https://console.cloud.google.com/apis/enableflow;apiid=auditmanager.googleapis.com)

     <br />

   - To enable Audit Manager on your organization, run the
     following command:

         gcloud beta services enable auditmanager.googleapis.com \
            --organization=ORGANIZATION_ID

     Replace `ORGANIZATION_ID` with your
     [Google Cloud organization
     ID](https://docs.cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id).

     For more information, see [Enable
     services](https://docs.cloud.google.com/service-usage/docs/hierarchical-service-activation/manage-enablement#enable).

   The Audit Manager service agent is created when you enable
   Audit Manager. When you enable Audit Manager at
   the project level, the service agent is
   `service-`<var translate="no">PROJECT_NUMBER</var>`@gcp-sa-audit-manager.iam.gserviceaccount.com`. When you enable
   Audit Manager at the organization level, the service agent is
   `service-org-`<var translate="no">ORGANIZATION_ID</var>`@gcp-sa-audit-manager.iam.gserviceaccount.com`.
3. Configure Audit Manager to support [VPC Service Controls service
   perimeters](https://docs.cloud.google.com/audit-manager/docs/configure-vpcsc).

Audit Manager doesn't support the [jurisdictional
console](https://docs.cloud.google.com/assured-workloads/docs/jurisdictional-console).

## What's next

- [Set up permissions for your auditors](https://docs.cloud.google.com/audit-manager/docs/access-control).
- [Enroll resources for audit](https://docs.cloud.google.com/audit-manager/docs/enroll-resource).