SECURITY ATLAS / EVALUATION BRIEF Google Cloud Identity / Workforce Federation / Identity Platform Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/google-cloud-identity/ THE ATLAS TAKE Atlas judgment: This catalog entry is useful only when its three product boundaries stay visible. Cloud Identity manages identity resources in the Google account plane, Workforce Identity Federation lets external workforce identities access Google Cloud without turning them into ordinary synchronized Google accounts, and Identity Platform serves application customers. Start by selecting which job you are solving. Combining all three into an undifferentiated Google identity score would obscure architecture and commercial differences. For workforce federation, validate attribute mapping and IAM authority; for customer applications, validate token handling, tenancy and application authorization independently of successful authentication. SCOPE These are distinct products: Cloud Identity manages Google identities, Workforce Identity Federation maps an external identity provider into Google Cloud, and Identity Platform provides customer identity. Verify the selected product’s requirements separately. WORTH A LOOK WHEN Google-oriented organizations able to distinguish managed Google identities, external workforce federation and customer application login requirements. THINK TWICE WHEN A proposal assumes the three products share one user store, feature set, pricing model or lifecycle behavior. IMPLEMENTATION 1. Choose the identity job explicitly Separate Google account administration, external employee access and application customer login in the architecture and quote. 2. Define claims and authorization For workforce access, map stable attributes and narrow IAM grants; for applications, define token and resource-validation contracts. 3. Rehearse lifecycle by population Test disablement, session behavior and recovery independently for external workers, Google accounts and synthetic customers. OPERATING REALITY Cloud administrators and application developers own different parts of this identity estate. Atlas would assign an owner and lifecycle test to each population, then document which attributes and policies cross trust boundaries; a workforce access configuration should not silently become the customer application’s identity design. COMMERCIAL CONSIDERATIONS The three products have distinct commercial boundaries; obtain separate estimates for selected account administration, workforce access and application usage. - Cloud Identity edition and managed-account scope - Selected federation and Google resource requirements - Identity Platform usage and customer integration effort EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Validate a federated attribute change Acceptance evidence: Use a synthetic external worker and prove that changed or missing claims alter Google Cloud access only as intended. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Check population separation Acceptance evidence: Document the distinct objects, administrators and access paths for a workforce identity and a fictional application customer. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Prove application authorization Acceptance evidence: For the Identity Platform route, use a lab API to reject the wrong audience and prevent one synthetic customer from reading another’s records. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Which of Cloud Identity, Workforce Identity Federation, and Identity Platform is actually in the quote, and which job does each perform? - Does Workforce Identity Federation in the lab replace any corporate identity-provider functions, or only map groups into Google Cloud IAM? - Which team owns each identity population and prevents customer authentication from inheriting workforce administration privileges? EVIDENCE GAPS - No independent token-validation, federation-resilience or identity-lifecycle benchmark was performed. - Confirm feature availability, pricing and session-revocation behavior for the specific Google product selected from this grouped profile. SOURCES Cloud Identity documentation and identity resources (Documentation) https://docs.cloud.google.com/identity/docs Workforce Identity Federation (Documentation) https://docs.cloud.google.com/iam/docs/workforce-identity-federation Identity Platform product comparison (Documentation) https://docs.cloud.google.com/identity-platform/docs/product-comparison Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.