Cloud Identity
Cloud Identity is the identity foundation for everything else on GCP. It manages users and groups; IAM (the next service) decides what those users and groups are allowed to do. The two are separate services with separate scopes, and the most common beginner misunderstanding is that IAM creates user accounts. It does not — Cloud Identity creates them, IAM grants them permissions to resources.
Cloud Identity is also separate from Google Workspace. Workspace customers get Cloud Identity bundled with the productivity apps; a company can also subscribe to Cloud Identity alone, without Workspace, when they need user management on GCP without the Gmail-and-Docs stack.
Identity Foundation for GCP
Cloud Identitywhoalice@) and groups (data-team@). The source of truth everything else trusts. It does not grant any access by itself.
IAMwhat is alloweddata-team@ → roles/storage.admin. It cannot create identities — a binding to a principal that does not exist is dead weight.Separation of concerns: Cloud Identity owns the principals, IAM owns the permissions. Confusing the two is the most common identity mistake on GCP.
Every GCP user, group, and service account ultimately resolves through Cloud Identity (or an external IdP federated into it). When an IAM policy grants the roles/storage.objectAdmin role to alice@example.com, the alice@example.com identity must exist in Cloud Identity — created directly, synced from an external IdP, or federated. Without that identity, the IAM binding is a dangling reference. The mental model: Cloud Identity gives IAM something to bind to.
Cloud Identity Free vs Premium
Cloud Identity ships in two tiers. Free covers the essentials: user accounts, groups, basic single sign-on (SAML, OIDC), enforced multi-factor authentication, and a small set of administrative features. For most teams adopting GCP, Free is sufficient.
Premium adds advanced features: full mobile device management (MDM), advanced audit logs, secure LDAP for legacy apps, and additional administrative controls. Premium earns its place in regulated environments and at organizations that genuinely need device-level enforcement. Check the feature list before subscribing — Premium without using its features is just a higher bill.
Workforce Identity Federation
Most enterprises already have a primary identity provider — Azure Entra ID, Okta, Ping, ADFS. Workforce Identity Federation lets GCP trust that external IdP for authentication, without provisioning duplicate users in Cloud Identity. Users log in to GCP via the IdP they already use; no Google accounts are created at all — group memberships and attributes arrive with each SAML or OIDC assertion through attribute mapping. (The alternative approach — provisioning users into Cloud Identity via SCIM and signing in with SAML SSO — is a different architecture; do not mix the two mental models.) Federation is dramatically cleaner than maintaining two parallel sets of user accounts and reconciling them when people join, change roles, or leave.
Groups for Manageable IAM
The single most important pattern in Cloud Identity: bind IAM roles to groups, not to individual users. When Alice changes teams, you move her between groups instead of editing IAM policies on dozens of resources. When a new engineer joins the data team, they inherit data-team-group permissions automatically. The alternative — IAM bindings on individual user accounts — becomes unmanageable after the first headcount change. Groups exist for this reason; use them.
Cloud Identity vs Workspace
A frequent source of confusion. Workspace (formerly G Suite) is Google's productivity suite — Gmail, Drive, Docs, Meet — and includes Cloud Identity for the user accounts it manages. Cloud Identity standalone is just the identity service without the apps. If a company already uses Workspace, they already have Cloud Identity — no separate subscription needed. If a company uses Microsoft 365 for email but Google Cloud for infrastructure, Cloud Identity standalone (with Workforce Identity Federation to Entra) is the right fit.
- Believing IAM creates user accounts. IAM only authorizes; Cloud Identity provides the identities IAM binds to.
- IAM bindings on individual users instead of groups. Headcount changes turn into hours of policy edits.
- Maintaining parallel users in Cloud Identity and an external IdP. Workforce Identity Federation eliminates the dual maintenance.
- Cloud Identity Premium subscribed without using its Premium-only features. The bill is the same whether you use the features or not.
- MFA not enforced at the organization level. Individual users opt in inconsistently; security posture is uneven by design.
- No SCIM provisioning from the source IdP. New hires get accounts created manually, leavers retain access for weeks.
- Workforce Identity Federation in any organization that already has a corporate IdP. Single source of truth for who exists and what they belong to.
- IAM bindings to groups only. Never to individual users. The rule has no useful exceptions in production.
- Enforce MFA at the organization level through Cloud Identity policies — not per-user opt-in.
- SCIM provisioning from the source IdP so user lifecycle is automatic. Manual provisioning is where stale access lives.
- Quarterly review of admin accounts and group membership. Privilege creep is the silent failure mode of identity hygiene.
- Separate group naming conventions for IAM-bound groups versus communication groups. The two roles overlap in confusing ways otherwise.
Knowledge Check
What is the division of responsibilities between Cloud Identity and IAM?
- IAM creates and provisions the user accounts, while Cloud Identity manages the roles and permissions granted on those accounts
- Cloud Identity creates user accounts and manages groups; IAM grants those identities permissions to act on GCP resources
- Cloud Identity and IAM are simply two interchangeable names for one underlying service
- Cloud Identity manages the org's billing accounts and invoices; IAM is what manages the actual user identities
When does Workforce Identity Federation matter in an organization?
- Only when the production workload is deployed across two or more separate public cloud providers at the same time
- When the organization already has a corporate IdP (Entra, Okta, etc.) — federation avoids maintaining duplicate users in Cloud Identity and the source IdP
- When the organization already runs Google Workspace; Workforce Identity Federation is the mechanism required to wire Workspace together with the underlying Cloud Identity directory
- When the organization needs MFA enforced at the org level, since only federated identities are capable of supporting MFA
Why bind IAM roles to groups instead of individual users?
- IAM does not accept individual user accounts as principals at all — only group identities are permitted in role bindings
- Headcount changes (team moves, hires, leavers) turn into a single group membership edit rather than dozens of policy edits across resources
- Groups are billed at a noticeably lower per-binding rate than individual user accounts are charged
- Groups bypass the MFA enforcement step entirely, which is what makes them noticeably faster to use for service-to-service authentication flows
A company uses Microsoft 365 for email but Google Cloud for infrastructure. What is the right identity setup?
- Migrate the whole company from Microsoft 365 over to Google Workspace, since Cloud Identity comes bundled with Workspace
- Provision every single user manually in both Entra ID and Cloud Identity, then keep the two directories synced by hand
- Cloud Identity standalone (without Workspace) with Workforce Identity Federation to Entra ID — Entra remains the source of truth, GCP trusts it
- Cloud Identity Premium configured with the secure LDAP feature to bridge authentication directly across to the existing Microsoft 365 mailboxes
What is the principal difference between Cloud Identity Free and Premium?
- Free is capped at a hard limit of 50 users, whereas Premium removes the user limit entirely
- Free covers users, groups, basic SSO, and enforced MFA; Premium adds full MDM, advanced audit logs, secure LDAP, and additional admin controls
- Free is the tier required for federation with external IdPs, and upgrading to Premium turns federation off
- Free does not support IAM bindings of any kind whatsoever; Premium is the strict prerequisite for accessing any single IAM-protected GCP resource
You got correct