An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A well- established directory service is used to manage user identities and lifecycle management. This directory service must continue for the organization to use as the “source of truth” directory for identities. Which solution meets the organization's requirements?

Google Cloud Directory Sync (GCDS) is a utility that synchronizes identity data from an existing directory service, such as Microsoft Active Directory or an LDAP server, with Google Cloud Identity or Google Workspace. This allows an organization to continue using their established directory as the single source of truth for user and group management while provisioning those identities in Google Cloud. GCDS performs a one-way synchronization from the external directory to Google, ensuring that the on-premises system remains the authoritative source.

Cloud Identity is the destination directory service in Google Cloud, not the tool used for synchronization. It receives the identity data but does not pull it from the source. Security Assertion Markup Language (SAML) is a federation protocol for single sign-on (SSO), not for synchronizing user identities. It handles authentication, not account provisioning. Pub/Sub is a real-time messaging service for event-driven systems and is unrelated to identity lifecycle management or directory synchronization.

1. Google Cloud Documentation, "Google Cloud Directory Sync overview". GCDS is described as the tool to "synchronize your users and groups from your existing Active Directory or LDAP server."

2. Google Cloud Documentation, "Deciding on an authentication method". This page outlines different methods, stating, "To provision users and groups to Cloud Identity... you can use Google Cloud Directory Sync (GCDS)."

3. Google Cloud Documentation, "About Cloud Identity". This document defines Cloud Identity as the service that provides unified identity management, which serves as the target for GCDS synchronization.