An enterprise is configuring automated synchronization from Microsoft Entra ID to Cloud Identity to manage security groups and enforce least-privilege access policies across Google Cloud resources. The corporate security policy specifies the following requirements: The dedicated provisioning identity must operate with the minimum administrative privileges necessary in Cloud Identity and must not have full super-admin rights. End users must not be able to circumvent security policies or context-aware access bindings by unilaterally leaving provisioned groups. Which configuration should the administrator implement to meet these requirements?

Create a custom delegated administrator role with Admin API privileges enabled for Organization Units (Read), Users, and Groups for the provisioning user, and configure the groups as enforcement groups.: ### What this solution is This configuration establishes a **delegated administrator role** in the Google Admin Console with specific Admin API privileges and utilizes **enforcement groups** to secure membership and prevent policy circumvention. ### How it meets the requirements - **Principle of least privilege**: Rather than granting the built-in **super-admin** role (which grants unrestricted control over the entire Google Cloud organization, IAM policies, and Cloud Identity domain), creating a custom delegated admin role limits the automated provisioning identity (`azuread-provisioning`) strictly to the required API permissions: `Organization Units > Read`, `Users`, and `Groups`. - **Preventing policy circumvention**: By default, Cloud Identity access groups permit members to remove themselves from a group. When groups are used for access bindings and IAM-based policy enforcement, end users leaving a group can bypass mandatory controls. Setting them as **enforcement groups** restricts self-service group departure and guarantees policy enforcement. ### Key advantages and capabilities - **Granular API scoping**: Confines the provisioning integration to managing non-admin user lifecycles, group creation, and group memberships without exposing organizational settings. - **Tamper-resistant access controls**: Ensures synchronized groups maintain authoritative membership managed exclusively through the external identity provider. - **Reduced blast radius**: Prevents compromised provisioning credentials from escalating privileges or altering organization-wide settings. - **Seamless lifecycle propagation**: Synchronizes user additions, removals, and group memberships automatically to enforce consistent access across Google Cloud services. ### Why this is optimal Delegated administration provides the exact administrative boundary required for external directory synchronization, satisfying least privilege while enforcement groups ensure that context-aware access and IAM policies cannot be bypassed by end-user actions.

Automate Entra Id Cloud Identity Group Provisioning | Professional Cloud Security Engineer

Automate Entra Id Cloud Identity Group Provisioning

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is configuring automated synchronization from Microsoft Entra ID to Cloud Identity to manage security groups and enforce least-privilege access policies across Google Cloud resources. The corporate security policy specifies the following requirements:

The dedicated provisioning identity must operate with the minimum administrative privileges necessary in Cloud Identity and must not have full super-admin rights.
End users must not be able to circumvent security policies or context-aware access bindings by unilaterally leaving provisioned groups.

Which configuration should the administrator implement to meet these requirements?

Grant the super-admin role to the provisioning user and configure the provisioned groups as standard access groups with domain-wide delegation enabled.

Assign the IAM Security Admin role (roles/iam.securityAdmin) at the organization node to the provisioning user, and set up dynamic groups using CEL queries.

Grant the Identity Platform Admin role (roles/identityplatform.admin) to the provisioning user and configure SAML group attribute mapping during user login.

Create a custom delegated administrator role with Admin API privileges enabled for Organization Units (Read), Users, and Groups for the provisioning user, and configure the groups as enforcement groups.

Professional Cloud Security Engineer

Automate Entra Id Cloud Identity Group Provisioning

Related questions