Configuring Google SecOps Access via Workforce Identity Federation
Short answer
BD Integrate Google SecOps with the third-party IdP using Workforce Identity Federation and Grant the roles/chronicle.viewer role to the SOC team's IdP group in IAM.
Question
You are helping a new Google Security Operations (SecOps) customer configure access for their SOC team. The Google SecOps administrators currently have access to the instance. The customer is reporting that new Google SecOps users are not getting authorized to access the instance, but they are able to authenticate to the third-party identity provider (IdP). How should you fix the issue? (Choose two.)
Key Takeaways
The core concept is linking external identities to Google Cloud resources; the trap is confusing platform-level SOAR settings with cloud-level IAM permissions.
This question addresses configuring access for a SOC team in Google Security Operations using Workforce Identity Federation and IAM roles. It establishes that integrating the third-party IdP and granting specific viewer roles are the required steps.
Common mistake: Candidates often select Option E, assuming that basic permission settings within the SOAR Advanced Settings control platform-wide access, rather than understanding that IAM governs identity federation.
Expert Analysis
Why the Answer Is Correct
To allow users from a third-party identity provider (IdP) to access Google Cloud resources like Google SecOps, you must first establish trust. This is done by integrating the third-party IdP with Google Cloud using Workforce Identity Federation (Option B). Once the federation is established, the users are mapped to workforce identities. To grant them access to the instance, you must assign the appropriate IAM role, such as roles/chronicle.viewer, to the group associated with those identities in IAM (Option D). Without the federation step, the IdP users cannot be recognized or granted cloud-level permissions.Why the Other Options Are Wrong
Option A is incorrect because linking to a Google Cloud project is part of the infrastructure setup, but it does not solve the authentication/authorization issue for external users without federation. Option C is vague; while data access scopes are important, the primary mechanism for user authorization in this context is IAM roles assigned via Workforce Identity. Option E is incorrect because 'Basic permission' in SOAR Advanced Settings typically refers to internal SOAR configuration or license entitlements, not the federated identity authorization path required here. The community comment notes that feature authorization relies on Google Cloud IAM when using Workforce Identity Federation.Community Comment Notes
One commenter highlighted that Workforce Identity Federation allows external users to perform SSO and that IAM roles must be assigned to the principals within the Workforce Identity pool. Another commenter correctly dismissed Option E, noting that SOAR group mapping settings are not the correct lever for platform-wide access when using Workforce Identity Federation.Exam Strategy
When dealing with Google Cloud security tools and external IdPs, always look for 'Workforce Identity Federation' as the bridge for human users. Remember that IAM roles are the standard way to grant access to these federated identities.
Frequently Asked Questions
Why is Workforce Identity Federation required instead of just linking a GCP project?
Linking a project doesn't handle the authentication of external users. Federation is needed to map third-party IdP identities to Google Cloud workforce identities.
Can I use SOAR Advanced Settings to authorize all SOC users?
No, SOAR settings are for application-specific configurations. Platform-wide access for federated users is controlled via Google Cloud IAM.
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.
From public community threads 2
-
ssdny 👍 1B: Workforce Identity Federation must be configured to allow external users and groups from a third-party IdP to access Google Cloud resources and perform Single Sign-On (SSO). D: In IAM, grant access permissions by assigning roles to the principals within the Workforce Identity pool.
-
b925054 👍 1E doesn't seems right because feature authorization for the broader Google SecOps platform (including SIEM) relies on Google Cloud IAM when using Workforce Identity Federation, nothing to do with SOAR group mapping settings.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.