Associate Cloud Engineer

By Google · Question Mode

QuestionQ15

Configuring access and security

During a recent audit of your existing Google Cloud resources, you discovered several users with email addresses outside of your Google Workspace domain. You want to ensure that your resources are only shared with users whose email addresses match your domain. You need to remove any mismatched users, and you want to avoid having to audit your resources to identify mismatched users. What should you do?

Explanation

Organization policy constraints for domain restriction are not retroactive—they apply only to new IAM policy changes. To ensure all current users comply, you must set the constraint and then manually remove existing mismatched users. This two-step process prevents future violations while cleaning the current state.

Community Discussion

No comments yet. Be the first to start the discussion!