An organization is designing an automated identity synchronization architecture between their on-premises Active Directory Domain Services (AD DS) forest and Cloud Identity to enable workforce access to Google Cloud resources. The security team establishes the following requirements: User lifecycle management (creation, updates, suspensions) must be automated from AD DS to Cloud Identity without synchronizing user password hashes to Google Cloud. If the on-premises identity federation service experiences an outage or misconfiguration, administrators must still be able to re-authorize and manage the directory synchronization tool. The directory synchronization service account in Cloud Identity must follow isolation best practices and be protected against authentication lockouts. Which architectural and configuration approach should the organization implement?

Deploy Google Cloud Directory Sync (GCDS) on-premises, create a dedicated Cloud Identity administrator account for GCDS that is exempt from SAML Single Sign-On (SSO), and configure SAML 2.0 federation to delegate authentication to Active Directory.: ### What Google Cloud Directory Sync (GCDS) and SAML Federation Are **Google Cloud Directory Sync (GCDS)** is an on-premises synchronization tool that connects to an **LDAP directory** (such as Active Directory) to provision and synchronize users, groups, and organizational units into **Cloud Identity** or **Google Workspace**. GCDS performs one-way synchronization of identity metadata via the Google Directory API without reading or synchronizing user passwords. ### How it Meets the Requirements - **No password synchronization**: GCDS synchronizes user accounts, group memberships, and directory metadata, but does not synchronize passwords. Authentication is delegated back to on-premises **Active Directory Federation Services (AD FS)** or another SAML IdP via **SAML 2.0 single sign-on**, keeping credentials strictly on-premises. - **Resilience against SSO outages**: Creating a dedicated administrator account in Cloud Identity exclusively for GCDS and placing it in an Organizational Unit (OU) that is **exempt from single sign-on** ensures administrators can re-authorize GCDS using standard Google credentials even during an external IdP or AD FS failure. - **Account isolation**: Using a dedicated service account rather than a standard user account adheres to least-privilege principles and protects the provisioning pipeline from disruptions caused by individual employee lifecycle changes. ### Key Advantages - **Credential security**: Passwords never leave the corporate network; authentication occurs via secure SAML assertion exchanges. - **Automated lifecycle control**: Creation, modification, and suspension in Active Directory automatically reflect in Cloud Identity. - **High availability**: Excluding administrative provisioning accounts from SSO guarantees uninterrupted recovery and management access during federated identity downtime. - **Flexible schema mapping**: Supports custom LDAP queries, attribute mappings, and OU filtering rules. ### Why This Is Optimal This architecture combines automated metadata synchronization via **GCDS** with delegated authentication via **SAML SSO**, perfectly satisfying corporate data governance, zero password leakage, and disaster recovery requirements.

Gcds Active Directory Sync Architecture | Professional Cloud Security Engineer

Gcds Active Directory Sync Architecture

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An organization is designing an automated identity synchronization architecture between their on-premises Active Directory Domain Services (AD DS) forest and Cloud Identity to enable workforce access to Google Cloud resources. The security team establishes the following requirements:

User lifecycle management (creation, updates, suspensions) must be automated from AD DS to Cloud Identity without synchronizing user password hashes to Google Cloud.
If the on-premises identity federation service experiences an outage or misconfiguration, administrators must still be able to re-authorize and manage the directory synchronization tool.
The directory synchronization service account in Cloud Identity must follow isolation best practices and be protected against authentication lockouts.

Which architectural and configuration approach should the organization implement?

Configure Google Cloud Directory Sync (GCDS) to authenticate through the root Organization SAML profile, requiring all administrative sessions to validate against on-premises Active Directory.

Install Google Cloud Directory Sync (GCDS) alongside G Suite Password Sync (GSPS) on domain controllers, and map the primary domain administrator account to authenticate GCDS via SAML SSO.

Deploy Google Cloud Directory Sync (GCDS) on-premises, create a dedicated Cloud Identity administrator account for GCDS that is exempt from SAML Single Sign-On (SSO), and configure SAML 2.0 federation to delegate authentication to Active Directory.

Deploy Managed Service for Microsoft Active Directory in Google Cloud with a bidirectional forest trust, and execute the Active Directory Migration Tool (ADMT) to migrate users and password hashes.

Professional Cloud Security Engineer

Gcds Active Directory Sync Architecture

Related questions