Your organization has implemented synchronization and SAML federation between Cloud Identity and Microsoft Active Directory. You want to reduce the risk of Google Cloud user accounts being compromised. What should you do?

When using SAML federation with Active Directory (AD), the identity provider (IdP) is AD, which handles primary authentication, including password policies. Therefore, password strength must be enforced in AD. For the strongest account protection against phishing, 2-Step Verification (2SV) using security keys (FIDO) is recommended. Google prompts for this second factor after the user successfully authenticates with the IdP (post-SSO). This combination provides the most robust security posture for federated identities.

A. A Cloud Identity password policy is not enforced for federated users whose passwords are managed by an external IdP like Active Directory.
B. This is incorrect because the password policy is managed by AD, not Cloud Identity. Also, security keys are more secure than text/phone codes.
D. While the password policy location is correct, verification codes via text or phone are vulnerable to SIM swapping and phishing, making them less secure than security keys.

1. Google Cloud

Cloud Identity Documentation

"Set up single sign-on for managed Google Accounts using a third-party Identity provider". It states

"When SSO is enabled

users aren't prompted for a password by Google when they try to sign in. Instead

they are redirected to the third-party IdP to be authenticated." This confirms AD handles password authentication.

2. Google Admin Help

"Protect your business with 2-Step Verification"

Section: "Which verification methods can I use?". It highlights security keys as the "most secure" method because they use cryptography and are phishing-resistant.

3. Google Cloud Security Foundations Guide

"Authentication and authorization"

Page 21. "For federated identities

password policies are managed by the external identity provider."