Question

A company uses Okta as its primary identity provider and Google Cloud with Cloud Identity for its cloud resources. The security team wants new employees added in Okta to be automatically created as Cloud Identity users, and departing employees to be automatically suspended in Cloud Identity when disabled in Okta — all without deploying or maintaining any server infrastructure on-premises. Which approach should they implement?

Accepted Answer

Configure automated user provisioning in Okta using the SCIM-based Google Cloud/Google Workspace provisioning integration to push user lifecycle changes to Cloud Identity

Answer

Deploy Google Cloud Directory Sync (GCDS) on a Compute Engine VM and schedule it to sync the Okta user directory to Cloud Identity

Answer

Enable SAML SSO between Okta and Cloud Identity, which automatically provisions and deprovisions users on each sign-in event

Answer

Write a custom script using the Directory API and run it as a cron job on an on-premises server to poll Okta and update Cloud Identity