I followed the above (very carefully) but could not find 'Disable service account key creation' and therefore could not generate the create new key / JSON file?
Any advice? I'm SURE that 'Disable service account key creation' was not listed in Organisation Policies....