Associate Cloud EngineerDemo

By Google · Question Mode

QuestionQ19

Configuring access and security

Your organization currently manages user identities in Active Directory and wants to continue using Active Directory as the authoritative source of truth for those identities. At the same time, your organization wants full control over the Google accounts that employees use for all Google services, including your Google Cloud Platform (GCP) organization.

What should you do?

  • A Use Google Cloud Directory Sync (GCDS) to synchronize users into Cloud Identity.
  • B Use the cloud Identity APIs and write a script to synchronize users to Cloud Identity.
  • C Export users from Active Directory as a CSV and import them to Cloud Identity via the Admin Console.
  • D Ask each employee to create a Google account using self signup. Require that each employee use their company email address and password.
Explanation

Google Cloud Directory Sync (GCDS) is Google's purpose-built tool for synchronizing users, groups, and other data from an existing LDAP-compliant directory server, such as Active Directory, into Cloud Identity (and therefore into the GCP organization). Using GCDS keeps Active Directory as the single source of truth while automatically provisioning, updating, and deprovisioning corresponding Cloud Identity accounts, giving the organization centralized control over the Google identities used across all Google services, including GCP. Manual CSV export/import does not provide ongoing synchronization and is error-prone at scale, custom API scripting duplicates functionality already provided by GCDS, and self-signup accounts are unmanaged and give the organization no control over identity lifecycle.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!