nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #232

Your company is moving to Google Cloud. You plan to sync your users first by using Google Cloud Directory Sync (GCDS). Some employees have already created Google Cloud accounts by using their…

The correct answer is B. Use the transfer tool to migrate unmanaged users. When employees have already created unmanaged Google accounts using their corporate email addresses outside of an official Cloud Identity or Google Workspace domain, the correct approach is to use the 'Unmanaged Account Transfer Tool' (also referred to as the transfer tool in…

Submitted by akirajp· Apr 18, 2026Configuring access within a cloud solution environment

Question

Your company is moving to Google Cloud. You plan to sync your users first by using Google Cloud Directory Sync (GCDS). Some employees have already created Google Cloud accounts by using their company email addresses that were created outside of GCDS. You must create your users on Cloud Identity. What should you do?

Options

  • AConfigure GCDS and use GCDS search rules to sync these users.
  • BUse the transfer tool to migrate unmanaged users.
  • CWrite a custom script to identify existing Google Cloud users and call the Admin SDK: Directory
  • DConfigure GCDS and use GCDS exclusion rules to ensure users are not suspended.

How the community answered

(44 responses)
  • A
    5% (2)
  • B
    77% (34)
  • C
    14% (6)
  • D
    5% (2)

Explanation

When employees have already created unmanaged Google accounts using their corporate email addresses outside of an official Cloud Identity or Google Workspace domain, the correct approach is to use the 'Unmanaged Account Transfer Tool' (also referred to as the transfer tool in Google's documentation). This tool sends an email to the affected users, prompting them to either transfer their existing unmanaged account into the managed Cloud Identity domain or create a new personal account and vacate the business email address. GCDS (A, D) is designed to sync directory data from an existing LDAP/AD source; it does not resolve conflicts with pre-existing unmanaged accounts - attempting to sync without first resolving these would result in GCDS suspending or failing on those accounts. A custom Admin SDK script (C) would not handle the account transfer workflow, which requires user consent and Google's built-in transfer mechanism.

Topics

#Cloud Identity#Google Cloud Directory Sync (GCDS)#Unmanaged Users#User Migration

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice