An enterprise is planning to migrate several core business applications to Google Cloud while maintaining its existing Microsoft Entra ID (formerly Azure Active Directory) as the authoritative identity provider (IdP). The organization wants to implement automated user provisioning and Single Sign-On (SSO) with Cloud Identity to support centralized access control. The architecture must satisfy the following requirements: End users must log in to Google Cloud using their existing corporate identity credentials without credential duplication. User mapping between Microsoft Entra ID and Cloud Identity must minimize sign-in confusion and ensure notification emails reach user inboxes. The identity design must strictly follow Google Cloud domain verification and naming requirements. Which identity federation strategy should the cloud architect implement?

Register the enterprise's custom DNS domain in Cloud Identity, map Microsoft Entra ID User Principal Names (UPNs) with the custom domain suffix to Cloud Identity email addresses, and configure SAML 2.0 SSO: ### What Cloud Identity Federation with Entra ID is **Cloud Identity federation** establishes a trust relationship between Google Cloud and an external Identity Provider (IdP) such as **Microsoft Entra ID**. By pairing automated directory synchronization with **SAML 2.0 Single Sign-On (SSO)**, user identities and credentials remain centralized in Entra ID while granting access to Google Cloud resources. ### How it meets the requirements - **Consistent user experience:** Mapping Microsoft Entra ID **User Principal Names (UPNs)** directly to primary email addresses in Cloud Identity ensures users enter the exact same identifier (`user@example.com`) on both the Google Cloud sign-in prompt and the Entra ID redirect screen. - **Domain verification:** Cloud Identity requires establishing ownership of all associated domains via DNS validation. Using the verified custom domain ensures compliance with Cloud Identity directory standards. - **Email delivery:** Because corporate UPNs matching the custom domain typically function as valid email addresses, system notifications and IAM alerts are reliably routed to the user's primary mailbox. ### Key advantages - **Centralized access lifecycle:** Deprovisioning or suspending an employee in Entra ID instantly revokes Google Cloud access. - **No password replication:** Passwords remain stored solely in Entra ID, enforcing centralized MFA and conditional access policies. - **Deterministic identity mapping:** Guarantees identity uniqueness across both directories and avoids namespace collisions. ### Why this is optimal Mapping Entra ID UPNs configured with custom domain suffixes to Cloud Identity email addresses aligns the authentication identifier with the notification transport address, eliminating user confusion during identity-provider redirects.

StudyCerts

Entra Id Cloud Identity Sso Federation Design | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Entra Id Cloud Identity Sso Federation Design

Section: Integrating solutions with existing systems

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is planning to migrate several core business applications to Google Cloud while maintaining its existing Microsoft Entra ID (formerly Azure Active Directory) as the authoritative identity provider (IdP).

The organization wants to implement automated user provisioning and Single Sign-On (SSO) with Cloud Identity to support centralized access control. The architecture must satisfy the following requirements:

End users must log in to Google Cloud using their existing corporate identity credentials without credential duplication.
User mapping between Microsoft Entra ID and Cloud Identity must minimize sign-in confusion and ensure notification emails reach user inboxes.
The identity design must strictly follow Google Cloud domain verification and naming requirements.

Which identity federation strategy should the cloud architect implement?

Create an unmanaged consumer Google account for each user using their corporate email address and grant permissions directly in Google Cloud IAM

Configure Cloud Identity to synchronize users directly from Microsoft Entra ID Microsoft Online Email Routing Addresses (MOERAs) without configuring custom domains

Register the tenant's initial onmicrosoft.com domain in Cloud Identity and map Entra ID ObjectIds to Cloud Identity user identifiers

Register the enterprise's custom DNS domain in Cloud Identity, map Microsoft Entra ID User Principal Names (UPNs) with the custom domain suffix to Cloud Identity email addresses, and configure SAML 2.0 SSO

Professional Cloud Architect

Entra Id Cloud Identity Sso Federation Design

Related questions