How to Manage Corporate and Public User Identities in Google Cloud?

Customer Identity and Access Management

Answer Correct answer: D — Implement Google Cloud Identity Platform to centrally manage authentication and authorization for both corporate and public application users.

Your organization is developing an application that will have both corporate and public end-users. You want to centrally manage those customers' identities and authorizations. Corporate end users must access the application by using their corporate user and domain name. What should you do?

Add the corporate and public end-user domains to domain restricted sharing on the organization.
Federate the customers' identity provider (IdP) with Workforce Identity Federation in your application's project.
Do nothing. Google Workspace identities will allow you to filter personal accounts and disable their access.
Use a customer identity and access management tool (CIAM) like Identity Platform. Correct Answer

google cloud identity platform customer identity and access management pcse exam practice workforce vs ciam

Community Votes

57%

43%

57% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests the architectural distinction between Customer IAM (CIAM) and Workforce IAM, with candidates often mistakenly choosing workforce federation for public user scenarios.

This page explains how to centrally manage authentication for both internal employees and external customers using Google Cloud Identity Platform. It clarifies why CIAM outperforms workforce federation for public-facing applications.

Option B (Workforce Identity Federation) is frequently selected because it handles external federated logins, but it is architecturally intended for business partners and contractors rather than public application users.

Community Discussion (9 comments)

TibiMuhoho 👍 1 Selected: D

Workforce Identity Federation is designed for managing external workforce identities, such as contractors or business partners, not public-facing end-users. Therefore, cannot be B.

Pime13 👍 1 Selected: D

Option B suggests federating the customers' identity provider (IdP) with Workforce Identity Federation in your application's project. While Workforce Identity Federation is a powerful tool for integrating external identity providers, it is primarily designed for managing access to Google Cloud resources by external identities, such as contractors or partners, rather than managing end-user identities for an application. Using a customer identity and access management tool (CIAM) like Identity Platform (Option D) is more appropriate because it is specifically designed to handle both corporate and public end-user identities. It provides features like multi-factor authentication, user management, and integration with various identity providers, making it a comprehensive solution for managing diverse user bases.

BPzen 👍 1 Selected: D

For an application serving both corporate and public end-users, a Customer Identity and Access Management (CIAM) solution is the best approach. Google Cloud Identity Platform provides the tools necessary to centrally manage user authentication and authorization while supporting both corporate and public users. B. Federate the customers' identity provider (IdP) with Workforce Identity Federation in your application's project. Workforce Identity Federation is intended for internal workforce users (employees, contractors) to access Google Cloud resources, not for managing application users. It does not support public users, making it unsuitable for this use case.

nah99 👍 1 Selected: D

Torn b/w B & D. B just doesn't address the public end users at all. Question seems poorly written (who are the customers..)

KLei 👍 2 Selected: B

D is incorrect: the question specifically highlights the need for corporate users to access the application using their corporate user credentials, which is best addressed through Workforce Identity Federation.

dv1 👍 2

"the application will have both corporate AND PUBLIC END-USERS". This means that the solution applies to Identity Platform, therefore D.

json4u 👍 2

Obviously it's D. - Identity Platform : A customer identity and access management (CIAM) platform that lets users sign in to your applications and services. This is ideal for users who want to be their own identity provider, or who need the enterprise-ready functionality Identity Platform provides. - Workforce Identity Federation : This is an IAM feature that lets you configure and secure granular access for your workforce—employees and partners—by federating identities from an external identity provider (IdP).

brpjp 👍 3

B is correct - By federating your customers' IdP with WIF, you can provide a seamless authentication experience for your users while maintaining control over identity and access management in your Google Cloud environment.

yokoyan 👍 1 Selected: B

I think it's B.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Google Cloud Identity Platform is purpose-built as a Customer Identity and Access Management (CIAM) service. It enables centralized authentication and authorization for applications serving both corporate staff and public consumers. By integrating corporate directories alongside social or email providers, it satisfies the requirement for domain-based corporate logins while scaling securely for external traffic.

Why the Other Options Are Wrong

Option A addresses data sharing restrictions across domains, not identity management. Option B configures Workforce Identity Federation, which is strictly scoped to granting external personnel access to Google Cloud environments, not customer-facing apps. Option C relies on native Workspace controls that cannot natively authenticate or onboard public users without additional infrastructure.

Community Comment Notes

Several learners debated between federation and CIAM, noting that workforce tools lack public user onboarding capabilities. As one commenter observed, the explicit mention of "both corporate AND PUBLIC END-USERS" shifts the architecture toward a dedicated CIAM platform. Another noted that Workforce Identity Federation simply does not address the public segment at all. Consensus ultimately aligns with the official guidance for application-centric identity solutions.

Official Reference

Exam Strategy

When designing identity architectures, always distinguish between workforce access (internal/partner) and customer access (public/app). Select CIAM services like Identity Platform for external-facing applications, reserving workforce federation exclusively for secure cloud resource provisioning.

Frequently Asked Questions

Why is Workforce Identity Federation incorrect for public users?

WIF is architected solely for granting external personnel access to Google Cloud resources, lacking features for public customer onboarding and self-service registration.

Can Identity Platform handle corporate domain logins?

Yes. Identity Platform supports enterprise federation protocols like SAML and OIDC, allowing corporate users to authenticate seamlessly via existing organizational directories.

Related Analysis

← Back to PCSE Study Guide