2.3 Cloud Identity: Managing Users and Groups

Why This Topic Matters

Everything covered in sections 2.1 and 2.2 — the organization node, IAM bindings, org policy admins — depends on having actual identities to attach roles to. The exam guide's Domain 1 closes this loop with "Managing users and groups in Cloud Identity," and it is easy to underestimate this topic because it sounds like an HR task rather than a cloud-engineering one. On the exam, expect scenario questions about which product provisions identities and how to bring in an existing workforce directory without recreating every account by hand.

Quick Answer: Cloud Identity is Google's standalone Identity-as-a-Service (IdaaS) product for creating and managing the users and groups that IAM then grants roles to. It comes in a Free edition (default cap of 50 licensed users, more available on request at no cost) and a Premium edition (per-user billing, added enterprise mobile/device management and security features). You do not need Gmail or Google Workspace productivity apps to use it.

Cloud Identity vs. IAM vs. Google Workspace

These three are easy to conflate, and the exam expects you to keep them separate:

In practice: if a company only wants centralized login and IAM access for engineers — no Gmail, no Docs — they provision Cloud Identity Free on their own domain. If they already run Google Workspace for email, the Cloud Identity directory is already there; they don't provision it separately.

Cloud Identity Editions

A frequent exam-style trap: a scenario mentions a 20-person startup that wants IAM-manageable accounts but explicitly does not want to pay for email or productivity apps. The correct product is Cloud Identity Free, not Google Workspace Business Starter — Workspace bundles productivity apps the company doesn't want, and it isn't free at any tier.

The Organization Node Depends on This

Recall from section 2.1: a Google Cloud organization resource is only auto-created when the project creator authenticates with a Cloud Identity or Google Workspace account tied to a verified domain. Before that verification, there is no company-wide organization node — just standalone projects. This is why Cloud Identity setup is functionally a prerequisite step for any company that wants org-level folders, IAM inheritance, and organization policies rather than a pile of ungoverned individual projects.

Provisioning Users and Groups

Cloud Identity supports several ways to get users and groups into the directory, and the exam wants you to match the scenario to the right method:

• Manual creation in the Admin console — fine for a handful of accounts, or for creating individual Groups (e.g., data-analysts@example.com) that you then grant IAM roles to as a single principal instead of granting each person individually. Using groups this way is a best practice: when someone joins or leaves the team, you update group membership once instead of editing IAM bindings on every resource.
• Google Cloud Directory Sync (GCDS) — a free connector Google provides for organizations that already run an on-premises LDAP-based directory such as Active Directory. GCDS performs a one-way sync of existing users, groups, and organizational units into Cloud Identity/Workspace on a schedule, so a company with thousands of existing employee accounts doesn't need to recreate them by hand.
• Admin SDK Groups API / User invitation — programmatic provisioning for automation and self-service invite flows, useful when onboarding needs to be scripted rather than done by an admin clicking through a console.

The Super Admin Role

The Super Admin is the highest-privilege role in a Cloud Identity or Workspace account — it manages the directory itself (creating/suspending users, resetting passwords, configuring domains) and is the identity that, on first Google Cloud project creation, seeds the new organization's default IAM authority. Because Super Admin is extremely powerful and directory-wide (not scoped to Google Cloud IAM at all), best practice is to keep very few Super Admins and delegate day-to-day Google Cloud governance to the narrower Organization Administrator IAM role covered in section 2.1 — the exam rewards recognizing that these are two different admin layers (directory-level vs. Google-Cloud-resource-level).

Exam Scenario

An enterprise already manages 5,000 employee accounts in an on-premises Active Directory domain and wants those same identities usable as Cloud Identity principals — without an admin manually recreating 5,000 accounts, and without giving up the existing directory as the single source of truth for employee lifecycle events like terminations. The right answer is to deploy Google Cloud Directory Sync (GCDS), which synchronizes existing Active Directory users, groups, and organizational structure into Cloud Identity on an ongoing schedule, so onboarding/offboarding in Active Directory automatically reflects in Cloud Identity without duplicate manual work.

Takeaways for the Exam

• Cloud Identity manages users/groups (identity); IAM manages what those identities can do on Google Cloud resources; Google Workspace is a superset that adds productivity apps on top of the same directory.
• Cloud Identity Free defaults to 50 licensed users (more free on request); Premium is billed per user and adds device/mobile management — pick Free when a scenario explicitly wants no Gmail/Workspace cost.
• A Google Cloud organization node requires a verified Cloud Identity or Workspace domain; without one, projects stay standalone with no org-level IAM inheritance.
• Use Google Cloud Directory Sync (GCDS) to bring an existing on-prem Active Directory into Cloud Identity at scale, instead of manual account-by-account creation.
• Grant IAM roles to Groups rather than individual users wherever possible — it turns team changes into a one-time group-membership update instead of N separate IAM edits.