Your organization is migrating business critical applications to Google Cloud across multiple projects. You only have the required IAM permission at the Google Cloud organization level. You want to grant project access to support engineers from two partner organizations using their existing identity provider (IdP) credentials. What should you do?

Question

Accepted Answer

C. Create two workforce identity pools for the partner IdPs. Workforce Identity Pools, part of Workforce Identity Federation, are designed specifically for external identities like partner organizations to access Google Cloud resources using their existing identity providers (IdPs), without needing Google identities managed by your Cloud Identity account.

Answer

A. Create two single sign-on (SSO) profiles for the internal and partner IdPs by using SSO for Cloud SSO for Cloud Identity is typically used to federate your internal corporate directory with Google Cloud identities for your employees, not primarily for directly onboarding external partner organizations.

Answer

B. Create users manually by using the Google Cloud console. Assign the users to groups. Manually creating users in the Google Cloud console for partner engineers is not scalable and bypasses their existing IdP credentials, which is explicitly a requirement.

Answer

D. Sync user identities from their existing IdPs to Cloud Identity by using Google Cloud Directory Google Cloud Directory Sync (GCDS) is used to synchronize user identities from an on-premises directory to Cloud Identity, typically for an organization's own employees, not for federating external partner organizations' IdPs.

Your organization is migrating business critical applications to Google Cloud across multiple projects. You only have the required IAM permission at the Google Cloud organization level. You want to…

Question

Options

How the community answered

Why each option

Topics

Community Discussion