Granting Partner Access via Workforce Identity Federation

PCSE By islever Editorial Last updated

Short answer

C Create two workforce identity pools for the partner IdPs to enable federated access using their existing credentials.

Question

Your organization is migrating business critical applications to Google Cloud across multiple projects. You only have the required IAM permission at the Google Cloud organization level. You want to grant project access to support engineers from two partner organizations using their existing identity provider (IdP) credentials. What should you do?
  1. Create two single sign-on (SSO) profiles for the internal and partner IdPs by using SSO for Cloud Identity.
  2. Create users manually by using the Google Cloud console. Assign the users to groups.
  3. Create two workforce identity pools for the partner IdPs. Correct Answer
  4. Sync user identities from their existing IdPs to Cloud Identity by using Google Cloud Directory Sync (GCDS).

Key Takeaways

The exam tests the distinction between workforce identity federation (for temporary/external access) and directory sync (for permanent employees), with the trap being the assumption that all external users must be synced to Cloud Identity.

This question tests the correct method for granting external partners access to Google Cloud using their existing IdP credentials without syncing identities. Community consensus confirms that Workforce Identity Federation is the standard solution for this scenario.

Common mistake: Many candidates choose D (GCDS) because they assume all users must be present in Cloud Identity, failing to recognize that 'partner organizations' implies a need for federated access rather than synchronized accounts.

Expert Analysis

Why the Answer Is Correct

Workforce Identity Federation allows you to use an external identity provider (IdP) to authenticate users who are not part of your organization's core workforce, such as partners or contractors. By creating workforce identity pools, you map these external identities to Google Cloud IAM roles, enabling secure access without needing to migrate user data into Google Cloud Identity.

Why the Other Options Are Wrong

Option A refers to SSO profiles typically used for primary workforce authentication within Cloud Identity, not necessarily for federating external partner IdPs in this specific context. Option B suggests manual creation, which is unscalable and ignores the requirement to use existing IdP credentials. Option D (GCDS) synchronizes users from an on-premises Active Directory to Cloud Identity, which is designed for internal employees, not external partners who should remain managed by their own IdPs.

Community Comment Notes

Comment [1] highlights that Workforce Identity Federation avoids the need to synchronize user identities, directly addressing the prompt's constraints. Comments [2], [3], and [4] reinforce that this is a classic use-case for federation when dealing with outside identity providers, explicitly noting that GCDS is inappropriate for this specific partner scenario.

Official Reference

https://cloud.google.com/security/products/workforce-identity-federation

This link opens the official vendor documentation in a new tab.

Exam Strategy

When you see 'partners', 'contractors', or 'external IdP' in a PCSE question, immediately think of Workforce Identity Federation. Avoid synchronization tools like GCDS unless the question specifies that the external users are becoming permanent members of your organization's directory.

Frequently Asked Questions

Why is GCDS incorrect for partner access?

GCDS syncs users from an on-prem AD to Cloud Identity, treating them as internal employees. Partners should remain managed by their own IdPs via federation.

What is the difference between SSO profiles and workforce identity pools?

SSO profiles are often for primary workforce single sign-on. Workforce identity pools are specifically designed for federating external identities like partners and contractors.

More PCSE FAQ →

Community Votes

C
75%
D
25%

75% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. jmaquino 👍 2 Answered C
    Workforce Identity Federation lets you use an external identity provider (IdP) to authenticate and authorize a workforce—a group of users, such as employees, partners, and contractors—using IAM, so that the users can access Google Cloud services. With Workforce Identity Federation you don't need to synchronize user identities from your existing IdP to Google Cloud identities, as you would with Cloud Identity's Google Cloud Directory Sync (GCDS). Workforce Identity Federation extends Google Cloud's identity capabilities to support syncless, attribute-based single sign on.
  2. json4u 👍 2
    Answer is C. This case shows well when to use Work Force Federation.
  3. 3fd692e 👍 1 Answered C
    Classic workforce identity use-case because the question references outside identity providers. You wouldn't use GCDS in this scenario.
  4. dat987 👍 3 Answered C
    Answer is C
  5. yokoyan 👍 2 Answered D
    I think it's D.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide