Authentication with default GCE Service account - trace in different project where Grafana deploted

Hello,

We are using Google GMP (Google Cloud Managed Service for Prometheus) with several clusters , each one on different project.
Our infra resources like Prometheus UI & Grafana are deployed in one cluster but our trace sent to a different project (central) from all our gke projects (scoped project for several monitored projects)

Issue is when trying to authenticate Google trace plugin with default GCE Service account (after giving the SA the needed permissions) it fail.
So I also generate json file in the SA and used Google GWT file authentication and it worked. Than I switch back to default GCE Service account hit save&test and it worked (also deleted the generated json from the SA)

Seems when trying to authenticate with default GCE Service account it doesnt know where is the scope project.

Please advise
Thank you
Daniel