Your organization uses Active Directory (AD) to manage user identities. Each user uses this identity for federated access to various on-premises systems. Your security team has adopted a policy that r

The recommended approach for federating Active Directory identities with Google Cloud is to first synchronize user identities from AD to Google Cloud using Google Cloud Directory Sync (GCDS), which keeps user information consistent. Following this, enable SAML (Security Assertion Markup Language) for single sign-on (SSO), allowing users to authenticate against their Active Directory identity provider and gain access to Google Cloud services without re-entering credentials.

While syncing identities might be done via the Google Admin console, OAuth is primarily an authorization protocol, not an authentication protocol for user single sign-on from an external identity provider like AD.

Relying on 3rd party LDAP sync is less integrated than GCDS, and copying passwords is a significant security risk and not a Google-recommended practice for identity federation.

Copying passwords is a security anti-pattern and not a recommended practice for secure identity federation, making this option incorrect despite the correct initial sync method.