Your organization has users and groups configured in an external identity provider (IdP). You want to leverage the same external IdP to allow Google Cloud console access to all employees. You also wan

Question

Options

• AConfigure workforce identity federation with the external IdP, and set up attribute mapping.
• BConfigure a service account for each individual by using the user name and photo, and grant
• CConfigure workload identity federation to get the external IdP tokens, and use these tokens to
• DCreate a Google group that includes organization email IDs for all users. Ask users to use the

• A
  78% (32)
• B
  5% (2)
• C
  2% (1)
• D
  15% (6)

Explanation

Workforce Identity Federation is specifically designed for human users (as opposed to Workload Identity Federation, which is for applications/workloads) to access Google Cloud using external IdP identities - no Google accounts required. Attribute mapping lets you map IdP claims (e.g., 'displayName', 'picture') to Google attributes so the Cloud console can personalize the sign-in experience. Option B (service accounts per user) is incorrect because service accounts are for applications, not humans. Option C (Workload Identity Federation) is for service-to-service auth, not console user access. Option D (Google Group with org emails) requires users to have Google accounts and does not leverage the external IdP.

No community discussion yet for this question.