You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to…

To delegate management of access control permissions to each business unit effectively, organizing

projects into folders and assigning permissions to Google groups at the folder level allows for

scalable and manageable access control. Using Google Cloud Directory Sync (GCDS) to synchronize

users and groups from the on-premises directory service ensures that access controls are maintained

and updated automatically as users change roles or leave the company.

Steps:

Organize Projects in Folders: Create a folder structure in the Google Cloud Resource Manager to

organize projects by business unit.

Assign Permissions to Google Groups: Use IAM to assign necessary permissions to Google Groups at

the folder level, ensuring each business unit can manage access controls for their own projects.

Synchronize Users and Groups: Use GCDS to sync users and group memberships from your on-

premises directory service to Google Cloud Identity, ensuring that changes in the on-premises

directory are reflected in Google Cloud.

Reference::

Google Cloud Resource Manager

Google Cloud Directory Sync