QuestionQ19

Configuring access and security

Your organization currently manages user identities in Active Directory and wants to continue using Active Directory as the authoritative source of truth for those identities. At the same time, your organization wants full control over the Google accounts that employees use for all Google services, including your Google Cloud Platform (GCP) organization.

What should you do?

Explanation

Google Cloud Directory Sync (GCDS) is Google's purpose-built tool for synchronizing users, groups, and other data from an existing LDAP-compliant directory server, such as Active Directory, into Cloud Identity (and therefore into the GCP organization). Using GCDS keeps Active Directory as the single source of truth while automatically provisioning, updating, and deprovisioning corresponding Cloud Identity accounts, giving the organization centralized control over the Google identities used across all Google services, including GCP. Manual CSV export/import does not provide ongoing synchronization and is error-prone at scale, custom API scripting duplicates functionality already provided by GCDS, and self-signup accounts are unmanaged and give the organization no control over identity lifecycle.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!