Cloud Identity Study Notes

Cloud Identity is Google's identity-as-a-service platform for managing users, groups, and devices independently of Google Workspace. It provides the human identities that sign in to Google Cloud, supports single sign-on, and enforces basic device and password policies.

Key facts

• Cloud Identity provides user and group management for organizations that need Google identities without purchasing full Google Workspace collaboration apps.
• Every user who accesses Google Cloud needs an identity from Cloud Identity or Google Workspace; consumer Gmail accounts are not a managed enterprise identity.
• Administrators can provision accounts manually, through directory sync from systems such as Microsoft Active Directory, or via SAML federation.
• Google Cloud Directory Sync (GCDS) synchronizes users and groups from an LDAP directory into your Cloud Identity or Workspace domain.
• Workforce identity federation can map external identity provider users to Google Cloud access without provisioning full managed accounts for each person.
• Cloud Identity supports single sign-on with SAML and OIDC, plus multi-factor authentication enforcement through methods such as security keys and authenticator apps.
• Groups created in Cloud Identity are the same groups used as members in IAM bindings, linking identity management directly to access control.
• The free edition covers core identity features, while Premium adds advanced device management, context-aware access, and enhanced security controls.
• Account recovery, password policies, and session controls are administered centrally, reducing reliance on unmanaged personal accounts for company resources.

What the exam expects you to know

• Recommend Cloud Identity when an organization without Workspace needs managed Google accounts for employees to access Google Cloud.
• Use GCDS to keep Google identities synchronized with an existing on-premises directory instead of creating accounts by hand.
• Explain that IAM consumes identities but does not create them; user lifecycle management lives in Cloud Identity, Workspace, or a federated provider.
• Enforce multi-factor authentication at the identity layer for all users with administrative access to cloud resources.
• Use groups managed in Cloud Identity as IAM members so joiner and leaver changes propagate without editing project policies.
• Consider workforce identity federation when external or partner users need temporary cloud access tied to their existing corporate identities.

Cloud Identity vs Google Workspace: when to use which

Choose Cloud Identity when the organization only needs identities, groups, SSO, and device policies to access Google Cloud and other services, without email and office applications. Choose Google Workspace when the organization also wants Gmail, Drive, Docs, and Meet under the same domain, since Workspace includes identity management as part of the suite. Many companies start with Cloud Identity for cloud access and later add Workspace. On the exam, 'employees need Google accounts to use Google Cloud but we do not need Gmail' is a direct pointer to Cloud Identity. See also the Google Workspace notes.

Common exam traps

• IAM cannot create users; attempting to fix a missing account with a role binding fails because the identity must exist first.
• Letting staff use personal consumer Gmail accounts for company cloud access removes central control over recovery, MFA, and offboarding.
• Deleting a user in Cloud Identity immediately removes their sign-in ability, but resources they created and owned schedules may still need reassignment.
• Directory sync is one-way from the source directory by design; edits made only on the Google side can be overwritten on the next sync cycle.

Frequently asked questions

Do I need Google Workspace to use Google Cloud?

No, Cloud Identity alone provides the managed user accounts, groups, and sign-in security that Google Cloud requires. Workspace adds productivity applications on top of the same identity foundation. Organizations that already use Microsoft 365 for email commonly pair it with Cloud Identity purely for Google Cloud access control.

How does directory sync help with Cloud Identity?

Google Cloud Directory Sync reads users and groups from your existing LDAP or Active Directory and creates matching accounts in Cloud Identity on a schedule. New hires appear automatically and disabled accounts are suspended, keeping cloud access aligned with the corporate directory. Passwords are not synced by GCDS itself.

What is workforce identity federation?

Workforce identity federation lets employees sign in with an external identity provider and receive a Google Cloud identity representation without a provisioned Cloud Identity account. Administrators map provider attributes to access policies. It suits large or partner workforces where creating and maintaining individual managed accounts would be impractical.

Study aid disclaimer: Cloud Cert Notes is an independent educational study aid. It is not affiliated with, endorsed by, or sponsored by Google, Microsoft, Amazon, Oracle, or Alibaba. Google Cloud, Associate Cloud Engineer, and Cloud Digital Leader are trademarks of Google LLC; all other certification names and product names are trademarks of their respective owners. Always confirm service details against the official provider documentation before sitting an exam.