Question

Your organization uses an on-premises Active Directory as the authoritative source for identities. You have deployed Google Cloud Directory Sync (GCDS) to provision users into Cloud Identity, and SSO is federated to your AD FS provider via SAML. An employee is terminated and their account is disabled in Active Directory. Security requires that this person can no longer authenticate to any Google Cloud resource. What is the correct outcome you should expect and configure to guarantee immediate loss of access?

Accepted Answer

Because SSO is federated, disabling the AD account alone blocks new sign-ins, but you should also suspend or delete the Cloud Identity user via GCDS and revoke existing OAuth/session tokens to terminate active sessions.

Answer

Deleting the user only in the Google Admin console is sufficient, because GCDS will detect the deletion and prevent re-creation on the next sync.

Answer

Removing all IAM role bindings for the user's email in the affected projects is the only step needed, since IAM policy fully controls authentication.

Answer

Rotating the SAML signing certificate in Cloud Identity will immediately invalidate the terminated user's access without affecting other users.