An enterprise uses Microsoft Entra ID as its authoritative identity provider (IdP) and federates authentication to Google Cloud using SAML Single Sign-On (SSO). The organization is designing an automated user lifecycle management architecture to synchronize employee provisioning, security group assignments for IAM access, and deprovisioning workflows upon employee departure. The security team establishes the following design requirements: The dedicated account used by Microsoft Entra ID for automated provisioning in Cloud Identity must adhere to the principle of least privilege and avoid full super-admin permissions. When an employee departs, terminating their identity in Microsoft Entra ID must automatically and reliably revoke all Google Cloud access, including SSH access to Compute Engine virtual machines utilizing OS Login. Which solution should the enterprise implement?

Assign the provisioning service account a custom delegated administrator role in Cloud Identity with Admin API privileges for Users, Groups, and Organizational Units (Read), and configure automated SCIM provisioning from Microsoft Entra ID to propagate account suspension directly to Cloud Identity.: ### What Automated SCIM Provisioning and Delegated Administration Is Automated user lifecycle management between an external Identity Provider (**Microsoft Entra ID**) and **Google Cloud Identity** relies on System for Cross-domain Identity Management (**SCIM**) protocols. This architecture uses a dedicated provisioning service account in Cloud Identity to synchronize user identities, group memberships, and lifecycle status changes from the authoritative identity source into Google Cloud. ### How It Meets the Requirements - **Principle of Least Privilege:** Creating a custom delegated administrator role in the Google Admin Console and granting specific **Admin API privileges**—specifically `Users`, `Groups`, and `Organization Units > Read`—allows the provisioning user (`azuread-provisioning`) to manage standard users and security groups without granting unrestricted **super-admin** privileges across the Google Cloud organization. - **Complete Access and OS Login Revocation:** Disabling an employee in an external IdP only halts new federated SAML web browser authentications. However, Compute Engine **OS Login** evaluates identity validity and IAM permissions tied to the user's **Cloud Identity** account lifecycle. By automatically syncing account suspension or deletion events from Microsoft Entra ID to Cloud Identity via SCIM, OS Login instantly denies subsequent SSH authentication requests. ### Key Advantages and Capabilities - **Automated Lifecycle Synchronization:** Onboards, updates group memberships, and offboards users programmatically without administrative delay. - **Granular Privilege Delegation:** Avoids super-admin credential sprawl by scoping the provisioning user's access strictly to user and group management. - **Consistent Security Posture:** Ensures access revocations extend beyond web console sessions to terminal-level access like OS Login and API calls. - **Centralized Group-Based Access Control:** Synchronized Entra ID security groups can be bound directly to Google Cloud IAM roles or Identity-Aware Proxy (**IAP**) policies. ### Why This Is Optimal This architecture establishes a secure, least-privilege administrative bridge while guaranteeing that deprovisioning signals in the authoritative directory immediately invalidate all access pathways into Google Cloud.

Automated User Lifecycle Entra Id Cloud Identity | Professional Cloud Security Engineer

Automated User Lifecycle Entra Id Cloud Identity

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise uses Microsoft Entra ID as its authoritative identity provider (IdP) and federates authentication to Google Cloud using SAML Single Sign-On (SSO). The organization is designing an automated user lifecycle management architecture to synchronize employee provisioning, security group assignments for IAM access, and deprovisioning workflows upon employee departure.

The security team establishes the following design requirements:

The dedicated account used by Microsoft Entra ID for automated provisioning in Cloud Identity must adhere to the principle of least privilege and avoid full super-admin permissions.
When an employee departs, terminating their identity in Microsoft Entra ID must automatically and reliably revoke all Google Cloud access, including SSH access to Compute Engine virtual machines utilizing OS Login.

Which solution should the enterprise implement?

Grant the Entra ID provisioning connector the Security Admin role (roles/iam.securityAdmin) in Google Cloud IAM, and use Privileged Access Manager (PAM) to periodically scan and disable inactive user accounts.

Assign the super-admin role to the Microsoft Entra ID provisioning account in Cloud Identity, and rely on SAML token expiration to automatically terminate OS Login SSH sessions and Google Cloud resource access upon user departure.

Assign the provisioning service account a custom delegated administrator role in Cloud Identity with Admin API privileges for Users, Groups, and Organizational Units (Read), and configure automated SCIM provisioning from Microsoft Entra ID to propagate account suspension directly to Cloud Identity.

Configure Cloud Identity to enforce OS Login organizational policies across all projects, and grant individual users Compute OS Admin Login roles directly on each target Compute Engine VM instance metadata.

Professional Cloud Security Engineer

Automated User Lifecycle Entra Id Cloud Identity

Related questions