How to Manage Corporate and Public User Identities in Google Cloud?

PCSE By islever Editorial Last updated

Short answer

D Implement Google Cloud Identity Platform to centrally manage authentication and authorization for both corporate and public application users.

Question

Your organization is developing an application that will have both corporate and public end-users. You want to centrally manage those customers' identities and authorizations. Corporate end users must access the application by using their corporate user and domain name. What should you do?
  1. Add the corporate and public end-user domains to domain restricted sharing on the organization.
  2. Federate the customers' identity provider (IdP) with Workforce Identity Federation in your application's project.
  3. Do nothing. Google Workspace identities will allow you to filter personal accounts and disable their access.
  4. Use a customer identity and access management tool (CIAM) like Identity Platform. Correct Answer

Key Takeaways

Tests the architectural distinction between Customer IAM (CIAM) and Workforce IAM, with candidates often mistakenly choosing workforce federation for public user scenarios.

This page explains how to centrally manage authentication for both internal employees and external customers using Google Cloud Identity Platform. It clarifies why CIAM outperforms workforce federation for public-facing applications.

Common mistake: Option B (Workforce Identity Federation) is frequently selected because it handles external federated logins, but it is architecturally intended for business partners and contractors rather than public application users.

Expert Analysis

Why the Answer Is Correct

Google Cloud Identity Platform is purpose-built as a Customer Identity and Access Management (CIAM) service. It enables centralized authentication and authorization for applications serving both corporate staff and public consumers. By integrating corporate directories alongside social or email providers, it satisfies the requirement for domain-based corporate logins while scaling securely for external traffic.

Why the Other Options Are Wrong

Option A addresses data sharing restrictions across domains, not identity management. Option B configures Workforce Identity Federation, which is strictly scoped to granting external personnel access to Google Cloud environments, not customer-facing apps. Option C relies on native Workspace controls that cannot natively authenticate or onboard public users without additional infrastructure.

Community Comment Notes

Several learners debated between federation and CIAM, noting that workforce tools lack public user onboarding capabilities. As one commenter observed, the explicit mention of "both corporate AND PUBLIC END-USERS" shifts the architecture toward a dedicated CIAM platform. Another noted that Workforce Identity Federation simply does not address the public segment at all. Consensus ultimately aligns with the official guidance for application-centric identity solutions.

Official Reference

https://cloud.google.com/identity-platform/docs

This link opens the official vendor documentation in a new tab.

Exam Strategy

When designing identity architectures, always distinguish between workforce access (internal/partner) and customer access (public/app). Select CIAM services like Identity Platform for external-facing applications, reserving workforce federation exclusively for secure cloud resource provisioning.

Frequently Asked Questions

Why is Workforce Identity Federation incorrect for public users?

WIF is architected solely for granting external personnel access to Google Cloud resources, lacking features for public customer onboarding and self-service registration.

Can Identity Platform handle corporate domain logins?

Yes. Identity Platform supports enterprise federation protocols like SAML and OIDC, allowing corporate users to authenticate seamlessly via existing organizational directories.

More PCSE FAQ →

Community Votes

D
57%
B
43%

57% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. brpjp 👍 3
    B is correct - By federating your customers' IdP with WIF, you can provide a seamless authentication experience for your users while maintaining control over identity and access management in your Google Cloud environment.
  2. json4u 👍 2
    Obviously it's D. - Identity Platform : A customer identity and access management (CIAM) platform that lets users sign in to your applications and services. This is ideal for users who want to be their own identity provider, or who need the enterprise-ready functionality Identity Platform provides. - Workforce Identity Federation : This is an IAM feature that lets you configure and secure granular access for your workforce—employees and partners—by federating identities from an external identity provider (IdP).
  3. KLei 👍 2 Answered B
    D is incorrect: the question specifically highlights the need for corporate users to access the application using their corporate user credentials, which is best addressed through Workforce Identity Federation.
  4. dv1 👍 2
    "the application will have both corporate AND PUBLIC END-USERS". This means that the solution applies to Identity Platform, therefore D.
  5. Pime13 👍 1 Answered D
    Option B suggests federating the customers' identity provider (IdP) with Workforce Identity Federation in your application's project. While Workforce Identity Federation is a powerful tool for integrating external identity providers, it is primarily designed for managing access to Google Cloud resources by external identities, such as contractors or partners, rather than managing end-user identities for an application. Using a customer identity and access management tool (CIAM) like Identity Platform (Option D) is more appropriate because it is specifically designed to handle both corporate and public end-user identities. It provides features like multi-factor authentication, user management, and integration with various identity providers, making it a comprehensive solution for managing diverse user bases.
Show 4 more comments
  1. BPzen 👍 1 Answered D
    For an application serving both corporate and public end-users, a Customer Identity and Access Management (CIAM) solution is the best approach. Google Cloud Identity Platform provides the tools necessary to centrally manage user authentication and authorization while supporting both corporate and public users. B. Federate the customers' identity provider (IdP) with Workforce Identity Federation in your application's project. Workforce Identity Federation is intended for internal workforce users (employees, contractors) to access Google Cloud resources, not for managing application users. It does not support public users, making it unsuitable for this use case.
  2. TibiMuhoho 👍 1 Answered D
    Workforce Identity Federation is designed for managing external workforce identities, such as contractors or business partners, not public-facing end-users. Therefore, cannot be B.
  3. nah99 👍 1 Answered D
    Torn b/w B & D. B just doesn't address the public end users at all. Question seems poorly written (who are the customers..)
  4. yokoyan 👍 1 Answered B
    I think it's B.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide