Google Cloud Identity Cheat Sheet

Last updated on March 27, 2023

Google Cloud Identity Cheat Sheet

Cloud Identity is an API for provisioning and managing identity resources.
Is a unified identity, access, app, and endpoint management (IAM/EMM) platform that helps IT and security teams maximize end-user efficiency, protect company data, and transition to a digital workspace.

Features

Use a single admin console to manage user, access, app, and device policies.
Monitor your security and compliance posture with reporting and auditing capabilities, and investigate threats with Security Center.
Helps you enforce policies for personal and corporate devices.
Give users one-click access to apps with Single Sign-On (SSO).
Hybrid Identity Management
- Extend your on-premises directory to the cloud with Google Cloud Active Directory Sync.
- This will enable simpler access to traditional apps and infrastructure with secure LDAP.

Integrates with hundreds of applications out of the box.

Pricing

Cloud Identity has free and premium editions.
Premium edition charges your organization per month per user.

Validate Your Knowledge

Question 1

Your company has hundreds of user identities in Microsoft Active Directory. Your company needs to retain the use of your Active Directory as your source of truth for user identities and authorization. Your company requires to have full control over the employees’ Google accounts for all Google services as well as your Google Cloud Platform (GCP) organization.

What should you do?

Require each employee to set up a Google account using the self signup process. Mandate each employee to use their corporate email address and password.
Write a custom script using the Cloud Identity APIs to synchronize users to Cloud Identity.
Utilize Google Cloud Directory Sync (GCDS) to synchronize users into Google Cloud Identity.
Export the company’s users from the Microsoft Active Directory as a CSV file. Import them into Google Cloud Identity via the Admin Console.

Show me the answer!

Correct Answer: 3

All Google services, including Google Cloud, Google Marketing Platform, and Google Ads, rely on Google Sign-In to authenticate users. Instead of manually creating and maintaining user accounts in Cloud Identity or Google Workspace for each employee, you can federate Cloud Identity or Google Workspace with your external identity provider (IdP) such as Active Directory or Azure Active Directory.

Setting up federation typically entails the following:

Automatically provisioning relevant user accounts from an external authoritative source to Cloud Identity or Google Workspace.
Enabling users to use an external IdP to authenticate to Google services.

Google Cloud Directory Sync enables administrators to synchronize users, groups, and other data from an Active Directory/LDAP service to their Google Cloud domain directory.

Hence, the correct answer is: Utilize Google Cloud Directory Sync (GCDS) to synchronize users into Google Cloud Identity.

The option that says: Require each employee to set up a Google account using the self signup process. Mandate each employee to use their corporate email address and password is incorrect because this does not set up your Active Directory as the source of truth for user identities. This just lets users set up their own Google accounts.

The option that says: Write a custom script using the Cloud Identity APIs to synchronize users to Cloud Identity is incorrect because writing a custom script to synchronize user identities is not necessary as this will take a significant amount of time to perform. The better approach is to use the Google Cloud Directory Sync instead.

The option that says: Export the company’s users from the Microsoft Active Directory as a CSV file. Import them into Google Cloud Identity via the Admin Console is incorrect because exporting CSVs to Cloud Identity will only allow you to import the users but it does not set up your Active Directory as the source of user identities.

References:
https://cloud.google.com/architecture/identity/best-practices-for-federating
https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-introduction
https://tools.google.com/dlpage/dirsync/

Note: This question was extracted from our Google Certified Associate Cloud Engineer Practice Exams.

For more Google Cloud practice exam questions with detailed explanations, check out the Tutorials Dojo Portal:

Google Cloud Identity Cheat Sheet References:

https://cloud.google.com/identity
https://cloud.google.com/identity/docs/overview

Written by: Jon Bonso

Jon Bonso is the co-founder of Tutorials Dojo, an EdTech startup and an AWS Digital Training Partner that provides high-quality educational materials in the cloud computing space. He graduated from Mapúa Institute of Technology in 2007 with a bachelor's degree in Information Technology. Jon holds 10 AWS Certifications and is also an active AWS Community Builder since 2020.