An enterprise is integrating its corporate third-party Identity Provider (IdP) with Google Cloud using Cloud Identity as a Service Provider (SP). The security architect must satisfy the following technical requirements: Authenticate workforce users into the Google Cloud console using SAML 2.0 federation. Automatically provision user accounts in Cloud Identity upon their initial successful sign-in without relying on scheduled directory synchronization tools. Enforce a 1-hour session duration requiring re-authentication for administrative console sessions. Ensure break-glass super administrators can still log in directly using Google-managed credentials during an external IdP outage. Which configuration strategy should the architect implement in Cloud Identity?

Create a third-party SAML SSO profile in the Admin Console, enable Just-in-Time (JIT) provisioning, assign the SSO profile to user Organizational Units (OUs) while leaving the Super Admin OU set to Google IdP, and configure Google Cloud session control to enforce a 1-hour re-authentication limit.: ### What this solution is This configuration establishes a federated **SAML 2.0** authentication trust between an external Identity Provider (IdP) and Cloud Identity acting as the **Service Provider (SP)**, while using granular Organizational Unit (OU) policy assignments and session controls to enforce least privilege, resilience, and automated onboarding. ### How it meets the requirements * **SAML 2.0 authentication**: Configuring the **Third-Party SSO Profile** in the Google Admin Console with the IdP's Single Sign-On URL, Entity ID, and X.509 certificate establishes cryptographically signed trust for SP-initiated and IdP-initiated authentication flows. * **Just-in-Time (JIT) provisioning**: Enabling JIT provisioning within the SAML SSO profile allows Cloud Identity to parse incoming SAML assertions (`NameID` and core user attributes) and dynamically instantiate new user accounts upon first successful logon without pre-synchronizing via GCDS. * **Session length controls**: Setting **Google Cloud Session Control** to 1 hour forces users within the targeted OUs to re-authenticate with the IdP periodically, mitigating session hijacking and token persistence risks for privileged access. * **Break-glass resilience**: Cloud Identity supports OU-level and group-level SSO profile assignments. By assigning the external SSO profile exclusively to standard workforce OUs and keeping the **Super Admin OU** assigned to Google authentication (or allowing direct sign-in via `accounts.google.com/a/`), super administrators can authenticate natively using local credentials if the third-party IdP suffers downtime. ### Key advantages and capabilities * **Granular SSO scoping**: Allows phased rollouts, hybrid authentication models, and isolated administrative access paths across distinct organizational units. * **Elimination of sync infrastructure**: JIT provisioning removes the operational dependency on on-premises synchronization agents like Google Cloud Directory Sync (GCDS) for dynamic or partner user populations. * **Robust session governance**: Google Cloud session controls apply re-authentication timers specifically to Google Cloud console and CLI sessions while respecting IdP conditional access policies. * **Disaster recovery resilience**: Isolating break-glass administrator authentication prevents catastrophic administrative lockouts caused by third-party IdP failures. ### Why this is optimal This architecture directly addresses identity lifecycle, security enforcement, and high availability by using native Cloud Identity features without introducing unnecessary external proxies or unmanaged credential silos.

Configure Cloud Identity Saml Sso Jit Session | Professional Cloud Security Engineer

Configure Cloud Identity Saml Sso Jit Session

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is integrating its corporate third-party Identity Provider (IdP) with Google Cloud using Cloud Identity as a Service Provider (SP). The security architect must satisfy the following technical requirements:

Authenticate workforce users into the Google Cloud console using SAML 2.0 federation.
Automatically provision user accounts in Cloud Identity upon their initial successful sign-in without relying on scheduled directory synchronization tools.
Enforce a 1-hour session duration requiring re-authentication for administrative console sessions.
Ensure break-glass super administrators can still log in directly using Google-managed credentials during an external IdP outage.

Which configuration strategy should the architect implement in Cloud Identity?

Configure domain-wide SAML SSO with network mask restrictions to redirect all users to the IdP, enable Google Cloud Directory Sync (GCDS) real-time event webhooks for account creation, and adjust the OAuth 2.0 token lifetime in IAM settings to 60 minutes.

Create a third-party SAML SSO profile in the Admin Console, enable Just-in-Time (JIT) provisioning, assign the SSO profile to user Organizational Units (OUs) while leaving the Super Admin OU set to Google IdP, and configure Google Cloud session control to enforce a 1-hour re-authentication limit.

Implement Workload Identity Federation with SPIFFE-based agent identities, enable automatic service account provisioning, and apply VPC Service Controls with a 1-hour ingress re-evaluation rule.

Configure Workforce Identity Federation with OIDC attribute mapping, set up Just-In-Time user licensing in IAM Workload pools, and define Cloud IAM Condition policies with request timestamp constraints.

Professional Cloud Security Engineer

Configure Cloud Identity Saml Sso Jit Session

Related questions