An enterprise integrates an external Identity Provider (IdP) with Google Cloud Identity for Single Sign-On (SSO) and enforces OS Login organization-wide for all Compute Engine instances. A security audit discovers that when departing employees are disabled in the external IdP, they can still establish SSH sessions to Linux VMs via OS Login. How should the security team automate user lifecycle management to immediately revoke both Google Cloud console and OS Login SSH access upon employee departure?

Configure automated provisioning automation using the Directory API with delegated Admin API user privileges to immediately suspend or delete the Cloud Identity account upon IdP deactivation.: ### What Automated Cloud Identity Account Suspension Is Automated user lifecycle deprovisioning synchronizes account status between an authoritative external Identity Provider (or HR management system) and **Google Cloud Identity** using the **Directory API** (or automated SCIM/SAML connectors). By provisioning a dedicated automation identity granted delegated administrative privileges (**Admin API privileges** for `Users` and `Groups`), lifecycle events such as employee termination trigger immediate account suspension or deletion within Cloud Identity. ### How It Meets the Requirements - **Immediate OS Login access revocation**: OS Login authorizes SSH connections dynamically by evaluating the user's **Cloud Identity** status and corresponding IAM permissions. When a user account is suspended or deleted in Cloud Identity, their POSIX SSH access is immediately invalidated. - **Console and API access revocation**: Disabling the Cloud Identity account terminates active sessions, invalidates OAuth tokens, and prevents new browser or programmatic access across Google Cloud. - **Least-privilege delegated automation**: Delegated administrative roles with granular Admin API privileges (`Users` and `Groups`) allow programmatic user lifecycle management without assigning broad super-admin access across the entire organization. ### Key Advantages - **Eliminates persistence risks**: Prevents orphaned active Cloud Identity accounts from bypassing SSO session boundaries for server-level SSH access. - **Centralized lifecycle synchronization**: Keeps identity state identical between the primary HR system/IdP and Google Cloud Identity. - **Automated governance**: Eliminates error-prone manual offboarding steps across distributed teams. - **Zero SSH key residual access**: Automatically invalidates OS Login POSIX profile keys linked to the deactivated Cloud Identity identity. ### Why This Is Optimal While disabling a user solely in an external IdP prevents *new SSO web browser logins*, it does not automatically modify or disable the existing Cloud Identity user object. Programmatically suspending the user in Cloud Identity via the Directory API guarantees that OS Login checks fail instantaneously upon offboarding.