Workforce identity federation: supported products and limitations

Overview

This page contains a list of Google Cloud products that support workforce identity federation, as well as a list of known product limitations.

Workforce identity federation provides customers with access to Google Cloud products using their native or other cloud identities.

Google Cloud products and limitations

This section lists products that support workforce identity federation and their associated limitations.

Supported products Identity federation launch stage Limitations

Access Context Manager

GA
UI: No known limitations
API:
  • v1alpha APIs aren't available for workforce identity federation users.
  • v1alpha APIs aren't available for workload identity federation workloads.
Other: No known limitations

Anthos

GA
UI:
  • When you log into any external (Anthos) clusters, the option Use your Google identity isn't available for workforce identity federation.
  • When you create or attach any external (Anthos) clusters, you won't automatically be added as an administrator for workforce identity federation.
API: The following APIs don't support workforce identity federation:
Other: gkeadm , gkectl and bmctl don't support workforce identity federation.

Anti Money Laundering AI

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

APIs and Services

GA
UI:
API: No known limitations
Other: No known limitations

Artifact Registry

GA
UI: No known limitations
API: No known limitations
Other:
  • Container Registry doesn't support identity federation. There is an information banner in the settings page in Container Registry transition .

BigQuery

GA
UI:
  • Scheduling queries isn't supported.
  • Saving queries isn't supported.
API:
Other:
  • The following features don't support workforce identity federation with BigQuery:
  • The following operations don't support workforce identity federation:
    • Loading data from Amazon S3, Azure Blob Storage, or Google Drive.

Binary Authorization

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Certificate Authority Service

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Certificate Manager

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Chronicle

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Cloud Asset Inventory

GA
UI: In the IAM policy tab, the Analyze Full Access button is unavailable for workforce identity federation users.
API: No known limitations
Other: No known limitations

Cloud Bigtable

GA
UI: The UI cost calculator isn't available for workforce identity federation users.
API: No known limitations
Other: No known limitations

Cloud Billing

GA
UI:
API:
Other: No known limitations

Cloud Build

GA
UI: Workforce identity federation users are unable to create host connections to GitHub.com in the Google Cloud console. Workforce identity federation users must create these connections programmatically.
API: In gcloud CLI, HTTP, and Terraform, when a workforce identity federation user runs the commands to connect to their GitHub.com or GitHub Enterprise host, the URLs returned will refer to console.cloud.google.com . The user must replace the host in the URL with the https://console.cloud.google/ when navigating to the links.
Other: No known limitations

Cloud CDN

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Cloud Composer

GA
UI: No known limitations
API: No known limitations
Other:
  • Cloud Composer supports workforce identity federation only for environments created in Composer version 2.1.11 or later and Airflow version 2.4.3 or later. Upgrading an environment from an earlier version does not enable workforce identity federation support.
  • Email messages sent from Airflow only include the Airflow UI link that is accessible by Google accounts. To access Airflow UI as a workforce identity federation user, the link must be manually updated (changed to the URL for workforce identity federation users ).
  • Cloud Storage limitations apply to Cloud Composer environment bucket.

Cloud Console

GA
UI: Workforce identity federation users can only access the Google Cloud workforce identity federation console, also known as the console (federated) . They cannot access the Google Cloud console. The console (federated) provides limited access to only those Google Cloud products that support workforce identity federation. For more information, see About the console (federated) . Additionally, the console (federated) has the following limitations:
API: No known limitations
Other: Workforce identity federation users aren't eligible for Google Cloud Free Trial.

Cloud Customer Care

GA
UI:
  • Due to the limitations of Cloud Billing for workforce identity federation , billing related support is accessible only to the organization's administrator through the Google Cloud account used to set up the billing account.
  • Workforce identity federation users can upload—but not download—support case-related files. These files are visible to the Support Engineers who handle your cases.
  • Contact details (e.g. Email Address) cannot be changed for workforce identity federation users once interaction with Support has started.
API: Cloud Support API doesn't support workforce identity federation.
Other: No known limitations

Cloud Data Fusion

GA
UI: Workforce identity federation users can create, update, and delete instances, but they cannot access individual instances.
API: Workforce identity federation users can only manage instances, for example creating, updating, and deleting an instance, but they cannot access individual instances.
Other: No known limitations

Cloud Deploy

GA
UI: Cloud Storage buckets must have uniform bucket-level access enabled to view Cloud Deploy artifacts.
API: No known limitations
Other: Cloud Storage buckets created through Cloud Deploy have uniform bucket-level access enabled.

Cloud DNS

GA
UI: The Cloud Domains page isn't available.
API: Cloud DNS has a limitation on the number of name server shards. To learn more, see Name server limits . Before allocating the final name server shard, Cloud DNS verifies ownership of the domain, which cannot be performed for workforce identity federation users.
Other: No known limitations

Cloud Firewall

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Cloud Fleet Routing

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Cloud Functions

GA
UI:
  • Existing VPC connectors aren't listed for workforce identity federation. You must create them manually.
  • Build worker pools aren't supported for workforce identity federation.
  • Pre-deployment testing isn't supported for workforce identity federation.
API: No known limitations
Other: No known limitations

Cloud HSM

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Cloud Intrusion Detection System

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Cloud Key Management Service

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Cloud Load Balancing

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Cloud Logging

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Cloud Monitoring

GA
UI:
API: No known limitations
Other: The legacy Cloud Monitoring agent doesn't support sending metrics with identity federation. Instead, workforce identity federation users can install the Ops Agent .

Cloud NAT

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Cloud Run

GA
UI:
API: No known limitations
Other: The IAM permission run.routes.invoke , which manages access to Cloud Run service endpoints, doesn't support workforce identity federation.

Cloud Scheduler

GA
UI:
  • The App Engine Cron Jobs tab isn't available for workforce identity federation users.
  • The App Engine option in the target type configuration isn't available for workforce identity federation users.
API: The Cloud Scheduler API does not support workforce identity federation for jobs that have their target attribute set to appEngineHttpTarget . To send a job to an App Engine target using workforce identity federation, create your job with the target type set to httpTarget and the uri field set to the full URI path of your App Engine target.
Other: No known limitations

Cloud Spanner

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Cloud SQL

GA
UI: No known limitations
API: No known limitations
Other:

Cloud Storage

GA
UI:
  • Viewing object details requires uniform bucket-level access to be enabled for the bucket.
  • Process with Cloud Functions isn't supported.
  • Scan with Cloud Data Loss Prevention isn't supported.
API:
Other: No known limitations

Cloud Tasks

GA
UI: The App Engine routing override option isn't available for workforce identity federation users.
API: The Cloud Tasks API does not support workforce identity federation for tasks that have App Engine targets.
  • App Engine queues: Since App Engine queues (queues created using a queue.yaml or queue.xml file) contain only tasks with App Engine targets, all tasks in these queues are not supported.
  • Regular queues: For regular Cloud Tasks queues, tasks with HTTP targets are supported. Tasks with App Engine targets are not supported (even though the queue is not an App Engine queue).
Other: No known limitations

Cloud Vision API

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Cloud Workstations

GA
UI: Workforce identity federation users who want to launch a Cloud Workstations must either use the Google Cloud console or the Workstations API. To use the Workstation API, see Connect to the workstation in your browser .
Workforce identity federation doesn't support re-authentication by directly accessing an existing Workstation, for example, if you've bookmarked your Workstation in the past. Instead, workforce identity federation users can re-authenticate as described earlier in this section.
API: No known limitations
Other: No known limitations

Compute Engine

GA
UI:
  • SSH-in-browser doesn't support workforce identity federation.
  • Batch isn't supported. We recommend that you use the gcloud CLI instead of the Google Cloud console.
API:
Other: No known limitations

Confidential Space

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Data Catalog

GA
UI: In the edit steward dialog on the entry details page, contact suggestions aren't shown.
API: No known limitations
Other: No known limitations

Dataflow

GA
UI: No known limitations
API: google.dataflow.v1beta3.SqlValidator.Validate : Dataflow SQL Validator APIs don't support workforce identity federation.
Other: No known limitations

Dataform

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Dataproc

GA
UI:
  • Workforce identity federation users can perform create, view, update, and delete operations in Cluster, Jobs, and Batches list pages. Workflows, Autoscaling policies, and component exchange aren't available to workforce identity federation users.
  • Cluster create functionality is available, except for Dataproc on GKE cluster creation, Dataproc Compute Engine cluster with personal authentication, or with Component Gateway enabled.
  • The "Output" section in the Batch and Job detail page isn't available for workforce identity federation users.
  • The "Recommend Alert" section in the Cluster and Job list page isn't available for workforce identity federation users.
API:
Other: No known limitations

Dataproc Metastore

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Datastore

GA
UI: Key Visualizer doesn't support workforce identity federation.
API: No known limitations
Other: No known limitations

Eventarc

GA
UI: Although you can use an existing workflow as an Eventarc trigger destination, workforce identity federation users can't create new workflows.
API: Third-party event publishing using a ChannelConnection resource is not supported with workforce identity federation.
Other: No known limitations

Filestore

GA
UI: Billing information isn't visible on the Instance create , Instance edit , and Restore backup to New instance pages.
API: No known limitations
Other: No known limitations

Firestore

GA
UI:
API: No known limitations
Other: No known limitations

Google Cloud Armor

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Google Cloud Marketplace

GA
UI:
  • Cloud Marketplace contains links to Google domains that might not support workforce identity federation.
  • VM deployments don't support workforce identity federation.
  • SaaS sign-up and SSO login do not support workforce identity federation.
  • Producer Portal doesn't support workforce identity federation.
  • Request Procurement does not support workforce identity federation.
  • Service Catalog doesn't support workforce identity federation.
API: Partner API doesn't support workforce identity federation.
Other: Customers don't receive notifications if no email address is provided by Billing Account Admins or Product Owners.

Google Cloud Migration Center

Preview
UI:
API: No known limitations
Other: No known limitations

Google Cloud SDK

GA
UI: No known limitations
API: No known limitations
Other: The Ruby and PHP The Cloud Client Libraries do not support workforce identity federation.

Google Kubernetes Engine

GA
UI: Container Registry tab isn't available for workforce identity federation. Artifact Registry is available.
API: No known limitations
Other: No known limitations

Hybrid Connectivity

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Identity and Access Management

GA
UI:
  • The Name column within the IAM table doesn't show display names for Google identities.
  • When adding new principals to allow policies, the Add principals text field supports only autocompletion for service accounts.
  • The Add exempted principal text field in the Audit Logs page supports only autocompletion for service accounts.
API: No known limitations
Other: No known limitations

Identity Platform

GA
UI: Workforce identity federation administrators must enable Identity Platform through the Firebase Authentication console or by logging into the Google Cloud console using a Google Cloud account before workforce identity federation users can access Identity Platform through the Google Cloud workforce identity federation console.
API: The following APIs don't support workforce identity federation:
  • google.cloud.identitytoolkit.admin.v2.ProjectConfigService.EnableIdentityPlatform
  • google.cloud.identitytoolkit.admin.v2.ProjectConfigService.InitializeIdentityPlatform
Other: No known limitations

Immersive Stream for XR

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Live Stream API

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Managed Service for Microsoft Active Directory

GA
UI: No known limitations
API: No known limitations
Other: Workforce identity federation users can't use IAP TCP forwarding to access the Active Directory management VM .

Media CDN

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Memorystore

UI: No known limitations
API: The following APIs support workforce identity federation:
Other: No known limitations

Migrate to Containers

Preview
UI: No known limitations
API: No known limitations
Other: No known limitations

Network Connectivity Center

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Network Intelligence Center

GA
UI: Firewall Insights cannot be exported to JSON or CSV.
API: No known limitations
Other: No known limitations

Network Service Tiers

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Organization Policy Service

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Policy Intelligence

GA
UI:
  • Troubleshooting within the Google Cloud workforce identity federation console, also known as the console (federated), is unsupported.
  • Simulating changes to an allow policy within the console (federated) is unsupported.
  • Analyzing IAM policies within console (federated) is unsupported.
API:
  • The Policy Troubleshooter API doesn't support group membership checks or domain membership checks for workforce identity federation users and workload identity federation users. For example, if an attempt is made by a workforce identity federation user to troubleshoot access and the role binding or deny rule contains a group or domain, Policy Troubleshooter displays in the response that the principal's membership in the group or domain is unknown.
  • The Policy Simulator API is unsupported.
  • The following APIs are unsupported:

Other: No known limitations

Private Service Connect

GA
UI: When publishing a service, DNS configuration is not available.
API: No known limitations
Other: No known limitations

Pub/Sub

GA
UI: No known limitations
API: Pub/Sub Lite API doesn't have endpoints that support workforce identity federation.
Other: No known limitations

Resource Manager

GA
UI:
  • Workforce identity federation users can only view and operate on the organization for which workforce identity federation was configured. Other organizations to which the users are added are not displayed in the Google Cloud console.
  • Wait times for certain operations to be reflected in the UI are long—for example, creating a project or folder.
API: The Organizations API doesn't support workforce identity federation.
Other: No known limitations

Secret Manager

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Security Command Center

GA
UI: Security Command Center is not supported in the Google Cloud console for workforce identity federation users.
API: No known limitations
Other: No known limitations

Sensitive Data Protection

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Service Infrastructure

Preview
UI: Managing quota in Cloud Endpoints is not supported.
API: Service Management API : Creating a managed service isn't supported for workforce identity federation users. To verify domain ownership and create a managed service, do the following:
  1. Add a service account to domain owners using Site Verification API
  2. Impersonate this service account to create a managed service
Other: No known limitations

Speaker ID

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Speech-to-Text

GA
UI: Only the v2 UI pages support workforce identity federation.
API: Only the v2 API supports workforce identity federation.
Other: No known limitations

Storage Transfer Service

Preview
UI: No known limitations
API: No known limitations
Other: No known limitations

Text-to-Speech

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Traffic Director

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Vertex AI

GA
UI: When workforce identity federation users create a new model monitoring job, Vertex AI doesn't prefill the alert email input with their email address.
API: Vertex AI doesn't send email messages to workforce identity federation users.
Other: Vertex AI Workbench doesn't support workforce identity federation.

Vertex AI Vision

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

Video Stitcher API

GA
UI: No known limitations
API: Workforce identity federation is not supported for LiveConfig and Slate resources when Google Ad Manager (GAM) fields are set.
Other: No known limitations

Virtual Private Cloud

GA
UI: No known limitations
API: No known limitations
Other: No known limitations

VPC Service Controls

Preview
UI: Autocomplete suggestions aren't supported when adding user identities in the following fields:
API:
Other: No known limitations

Workflows

GA
UI: The Grant button, which grants the workforce identity federation user the Service Account User ( roles/iam.serviceAccountUser ) role on the project, is inactive.
API: The Workflows and Workflow Executions APIs support workforce identity federation; however, when invoking other services during a workflow execution, workforce identity federation isn't supported.
Other: No known limitations