GCP OS Patch Management fails, is the service account missing a permission?

An OS Patch Management job for a new Windows Server VM fails with status No agent detected.

The gcloud os-config troublshoot command running from PowerShell on a windows GCE VM instance responds with GetServicePermissionDeniedException.

gcloud compute os-config troubleshoot {VMINSTANCE} --zone={ZONE}
OS Config troubleshooter tool is checking if there are issues with the VM Manager setup for this VM instance.

> Is the OS Config API enabled? Unknown
The troubleshooter encountered GetServicePermissionDeniedException while checking your instance.

All of the manual checks on that reference page succeed.

• osconfig.googleapis.com is enabled for the project.

• The Google Cloud OS Config Service Agent service-PROJECT_NUMBER@gcp-sa-osconfig.iam.gserviceaccount.com has the role Cloud OS Config Service Agent (roles/osconfig.serviceAgent).

• The connectivity tests pass and osconfig api can be called from PowerShell.

The VM uses a custom service account with scopes = ["cloud-platform"] but no IAM roles have been granted such as roles/compute.instanceAdmin.v1.

Is the custom service account missing a permission for this to work?

[EDIT]
Using IAM Policy Analyser I confirmed that the custom service account has Compute Instance Admin (v1) on the target VM instance resource.

Run the same command with debug and the exception is clear

gcloud compute os-config troubleshoot {VMINSTANCE} --zone={ZONE} --verbosity debug

During handling of the above exception, another exception occurred:
serviceusage.services.get 
    googlecloudsdk.api_lib.services.exceptions.GetServicePermissionDeniedException: PERMISSION_DENIED: Permission denied to get service [osconfig.googleapis.com]
error_code=110002&service=serviceusage.googleapis.com&permission=serviceusage.services.get&resource={PROJECT}
    type: googleapis.com
- '@type': type.googleapis.com/google.rpc.ErrorInfo
  domain: serviceusage.googleapis.com
  metadata:
    permission: serviceusage.services.get
    resource: 
    service: serviceusage.googleapis.com
  reason: AUTH_PERMISSION_DENIED

Or

ERROR: (gcloud.compute.os-config.troubleshoot) Could not fetch resource:

• Required 'compute.projects.get' permission for 'projects/PROJECT'

Or "permission": "osconfig.inventories.get"

So give the instance's service account these roles:

• roles/serviceusage.serviceUsageConsumer (on the project)
• roles/compute.osLogin.
• roles/osconfig.inventoryViewer

Now the troubleshoot runs, I can see that in my case, the No agent detected issue was resolved by removing this VM metadata field:
osconfig-disabled-features=tasks.