如需详细了解如何使用 Cloud Identity 或 Google Workspace 进行联合，请参阅单点登录。
员工身份联合
借助员工身份联合，您可以使用外部身份提供方 (IdP) 通过 IAM 对员工（一组用户，例如员工、合作伙伴和承包商）进行身份验证和授权，以便用户能够访问 Google Cloud 服务。借助员工身份联合，您无需像使用 Cloud Identity 的 Google Cloud Directory Sync (GCDS) 一样将用户身份从现有 IdP 同步到 Google Cloud身份。员工身份联合扩展了 Google Cloud的身份功能，可支持基于属性的非同步单点登录。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-21。"],[[["\u003cp\u003eThis page outlines methods for configuring user identities within your organization to enable access to Google Cloud services, differentiating this process from customer authentication for your applications.\u003c/p\u003e\n"],["\u003cp\u003eUsers can be granted access to Google Cloud through managed accounts, which are created and controlled via Cloud Identity or Google Workspace.\u003c/p\u003e\n"],["\u003cp\u003eFederated identities allow users to sign in to Google services using their existing credentials from an external identity provider (IdP), with or without synchronizing user accounts with Google Cloud.\u003c/p\u003e\n"],["\u003cp\u003eWorkforce Identity Federation enables workforce members, such as employees and partners, to use their existing external IdP credentials to access Google Cloud services without the need for account synchronization.\u003c/p\u003e\n"]]],[],null,["# Identities for users\n\nThis page describes the ways that you can configure identities for users in your\norganization so that they can access Google Cloud. It doesn't discuss the\nidentities that your customers use to authenticate to your application. To learn\nabout how to authenticate customers to your application, see the [Identity Platform\ndocumentation](/identity-platform/docs), which discusses customer identity and access\nmanagement (CIAM).\n\nFor users to access Google Cloud, they need an identity that Google Cloud\ncan recognize. There are several ways to configure identities so that\nGoogle Cloud can recognize them:\n\n- Create [Cloud Identity or Google Workspace accounts](#google-accounts)\n- Set up one of the following federated identity strategies:\n - [Federation using Cloud Identity or Google Workspace](#synced-federation)\n - [Workforce Identity Federation](#workforce)\n\nCloud Identity or Google Workspace accounts\n-------------------------------------------\n\nYou can use Cloud Identity or Google Workspace to create\n[managed user accounts](/architecture/identity/overview-google-authentication#managed_user_account). These accounts are called\n*managed accounts* because you control their lifecycle and configuration. Users\nwith these accounts can authenticate to Google Cloud and be authorized to\nuse Google Cloud resources.\n\nCloud Identity and Google Workspace share a common technical\nplatform. Both products offer similar features for managing\nusers, groups, and authentication.\n\nOnly Cloud Identity or Google Workspace managed Super Admin\naccounts can invite users with unmanaged [consumer accounts](/architecture/identity/overview-google-authentication#consumer_account)\nto transfer their consumer accounts to managed accounts.\n\nTo get started with Cloud Identity or Google Workspace, you can\ndo the following:\n\n- To learn more about using Cloud Identity and Google Workspace to create identities for your users, see [Google for organizations](/architecture/identity/overview-google-authentication#google_for_organizations).\n- Learn how to [set up Cloud Identity](https://support.google.com/cloudidentity/topic/7555414).\n- Learn how to [set up Google Workspace](https://support.google.com/a/answer/6365252).\n\nFederated user identities\n-------------------------\n\nYou can federate identities to allow users to use their existing identity and\ncredentials to sign in to Google services. There are several methods to\nfederate identities in Google Cloud.\n\n### Federation using Cloud Identity or Google Workspace\n\nWhen you federate identities with Cloud Identity or\nGoogle Workspace, users aren't prompted to enter a password when they\ntry to access Google services. Instead, you can redirect them to an [external\nidentity provider (IdP)](/architecture/identity/reference-architectures#using_an_external_idp) to authenticate.\n\nTo use this type of identity federation, a user must have an [external\nidentity](/architecture/identity/overview-google-authentication#external_identities) in the external IdP and a corresponding Google Account in\nCloud Identity or Google Workspace, typically with the same\nemail address. You can keep these accounts synchronized by using a tool like\n[Google Cloud Directory Sync (GCDS)](https://tools.google.com/dlpage/dirsync/) or by provisioning\naccounts using an [external authoritative\nsource](/architecture/identity/overview-google-authentication#external_authoritative_source). For example, you could set up account\nprovisioning with [Microsoft Entra ID](/architecture/identity/federating-gcp-with-azure-active-directory) or [Active Directory](/architecture/identity/federating-gcp-with-active-directory-introduction).\n\nTo learn more about federation using Cloud Identity or\nGoogle Workspace, see [Single sign-on](/architecture/identity/single-sign-on).\n\n### Workforce Identity Federation\n\nWorkforce Identity Federation lets you use an external identity provider (IdP)\nto authenticate and authorize a workforce---a group of *users* , such as employees,\npartners, and contractors---using IAM, so that the users can\naccess Google Cloud services. With Workforce Identity Federation you don't\nneed to synchronize user identities from your existing IdP to Google Cloud\nidentities, as you would with Cloud Identity's [Google Cloud Directory Sync\n(GCDS)](https://tools.google.com/dlpage/dirsync/).\nWorkforce Identity Federation extends Google Cloud's identity\ncapabilities to support syncless, attribute-based single sign-on.\n\nTo learn more about Workforce Identity Federation, see\n[Workforce Identity Federation overview](/iam/docs/workforce-identity-federation).\n\nWhat's next\n-----------\n\n- Learn about the ways to [authenticate to Google APIs with user\n credentials](/docs/authentication#user-accounts).\n- Learn how to [grant users access to resources](/iam/docs/granting-changing-revoking-access)."]]
