Granting Partner Access via Workforce Identity Federation
Your organization is migrating business critical applications to Google Cloud across multiple projects. You only have the required IAM permission at the Google Cloud organization level. You want to grant project access to support engineers from two partner organizations using their existing identity provider (IdP) credentials. What should you do?
Community Votes
75% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the distinction between workforce identity federation (for temporary/external access) and directory sync (for permanent employees), with the trap being the assumption that all external users must be synced to Cloud Identity.
This question tests the correct method for granting external partners access to Google Cloud using their existing IdP credentials without syncing identities. Community consensus confirms that Workforce Identity Federation is the standard solution for this scenario.
Many candidates choose D (GCDS) because they assume all users must be present in Cloud Identity, failing to recognize that 'partner organizations' implies a need for federated access rather than synchronized accounts.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Workforce Identity Federation allows you to use an external identity provider (IdP) to authenticate users who are not part of your organization's core workforce, such as partners or contractors. By creating workforce identity pools, you map these external identities to Google Cloud IAM roles, enabling secure access without needing to migrate user data into Google Cloud Identity.Why the Other Options Are Wrong
Option A refers to SSO profiles typically used for primary workforce authentication within Cloud Identity, not necessarily for federating external partner IdPs in this specific context. Option B suggests manual creation, which is unscalable and ignores the requirement to use existing IdP credentials. Option D (GCDS) synchronizes users from an on-premises Active Directory to Cloud Identity, which is designed for internal employees, not external partners who should remain managed by their own IdPs.Community Comment Notes
Comment [1] highlights that Workforce Identity Federation avoids the need to synchronize user identities, directly addressing the prompt's constraints. Comments [2], [3], and [4] reinforce that this is a classic use-case for federation when dealing with outside identity providers, explicitly noting that GCDS is inappropriate for this specific partner scenario.Official Reference
Exam Strategy
When you see 'partners', 'contractors', or 'external IdP' in a PCSE question, immediately think of Workforce Identity Federation. Avoid synchronization tools like GCDS unless the question specifies that the external users are becoming permanent members of your organization's directory.
Frequently Asked Questions
Why is GCDS incorrect for partner access?
GCDS syncs users from an on-prem AD to Cloud Identity, treating them as internal employees. Partners should remain managed by their own IdPs via federation.
What is the difference between SSO profiles and workforce identity pools?
SSO profiles are often for primary workforce single sign-on. Workforce identity pools are specifically designed for federating external identities like partners and contractors.