Google Cloud Identity

Cloud access begins with a person, not a permission.

Before Google Cloud can decide what someone may do, it needs an identity for that person. Cloud Identity provides a managed directory of workforce users and groups. It also provides controls for sign-in, applications, and endpoints.

That job is different from Google Cloud Identity and Access Management, usually called IAM. Cloud Identity answers, “Who is this user or group?” IAM answers, “What may this principal do on this resource?” You connect the two by granting IAM roles to users or groups from your Cloud Identity directory.

The core mental model

Treat Cloud Identity as the workforce identity layer around your Google services:

1. A verified domain establishes the organization’s namespace.
2. The Cloud Identity account contains managed users and groups for that domain.
3. Google Sign-In authenticates those users, either directly or through an external identity provider.
4. Google services recognize the resulting Google identities.
5. Google Cloud IAM policies grant those identities access to resources.

A Cloud Identity account is a directory container. It is not one employee’s login. A user account inside that directory is the employee’s managed Google Account.

This distinction matters during planning. Your directory contains people and groups. Your Google Cloud organization contains folders, projects, and service resources. One Cloud Identity or Google Workspace account can be associated with one Google Cloud organization resource.