如要進一步瞭解如何使用 Cloud Identity 或 Google Workspace 進行聯盟，請參閱「單一登入」。
員工身分聯盟
員工身分聯盟可讓您使用外部識別資訊提供者 (IdP)，透過 IAM 驗證工作團隊 (例如員工、合作夥伴和約聘人員等使用者群組) 並授權，讓使用者存取 Google Cloud 服務。使用員工身分聯盟時，您不需要像使用 Cloud Identity 的 Google Cloud Directory Sync (GCDS) 一樣，將現有 IdP 的使用者身分同步至 Google Cloud身分。員工身分聯盟擴充了 Google Cloud身分功能，支援無須同步處理的屬性型單一登入。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThis page outlines methods for configuring user identities within your organization to enable access to Google Cloud services, differentiating this process from customer authentication for your applications.\u003c/p\u003e\n"],["\u003cp\u003eUsers can be granted access to Google Cloud through managed accounts, which are created and controlled via Cloud Identity or Google Workspace.\u003c/p\u003e\n"],["\u003cp\u003eFederated identities allow users to sign in to Google services using their existing credentials from an external identity provider (IdP), with or without synchronizing user accounts with Google Cloud.\u003c/p\u003e\n"],["\u003cp\u003eWorkforce Identity Federation enables workforce members, such as employees and partners, to use their existing external IdP credentials to access Google Cloud services without the need for account synchronization.\u003c/p\u003e\n"]]],[],null,["# Identities for users\n\nThis page describes the ways that you can configure identities for users in your\norganization so that they can access Google Cloud. It doesn't discuss the\nidentities that your customers use to authenticate to your application. To learn\nabout how to authenticate customers to your application, see the [Identity Platform\ndocumentation](/identity-platform/docs), which discusses customer identity and access\nmanagement (CIAM).\n\nFor users to access Google Cloud, they need an identity that Google Cloud\ncan recognize. There are several ways to configure identities so that\nGoogle Cloud can recognize them:\n\n- Create [Cloud Identity or Google Workspace accounts](#google-accounts)\n- Set up one of the following federated identity strategies:\n - [Federation using Cloud Identity or Google Workspace](#synced-federation)\n - [Workforce Identity Federation](#workforce)\n\nCloud Identity or Google Workspace accounts\n-------------------------------------------\n\nYou can use Cloud Identity or Google Workspace to create\n[managed user accounts](/architecture/identity/overview-google-authentication#managed_user_account). These accounts are called\n*managed accounts* because you control their lifecycle and configuration. Users\nwith these accounts can authenticate to Google Cloud and be authorized to\nuse Google Cloud resources.\n\nCloud Identity and Google Workspace share a common technical\nplatform. Both products offer similar features for managing\nusers, groups, and authentication.\n\nOnly Cloud Identity or Google Workspace managed Super Admin\naccounts can invite users with unmanaged [consumer accounts](/architecture/identity/overview-google-authentication#consumer_account)\nto transfer their consumer accounts to managed accounts.\n\nTo get started with Cloud Identity or Google Workspace, you can\ndo the following:\n\n- To learn more about using Cloud Identity and Google Workspace to create identities for your users, see [Google for organizations](/architecture/identity/overview-google-authentication#google_for_organizations).\n- Learn how to [set up Cloud Identity](https://support.google.com/cloudidentity/topic/7555414).\n- Learn how to [set up Google Workspace](https://support.google.com/a/answer/6365252).\n\nFederated user identities\n-------------------------\n\nYou can federate identities to allow users to use their existing identity and\ncredentials to sign in to Google services. There are several methods to\nfederate identities in Google Cloud.\n\n### Federation using Cloud Identity or Google Workspace\n\nWhen you federate identities with Cloud Identity or\nGoogle Workspace, users aren't prompted to enter a password when they\ntry to access Google services. Instead, you can redirect them to an [external\nidentity provider (IdP)](/architecture/identity/reference-architectures#using_an_external_idp) to authenticate.\n\nTo use this type of identity federation, a user must have an [external\nidentity](/architecture/identity/overview-google-authentication#external_identities) in the external IdP and a corresponding Google Account in\nCloud Identity or Google Workspace, typically with the same\nemail address. You can keep these accounts synchronized by using a tool like\n[Google Cloud Directory Sync (GCDS)](https://tools.google.com/dlpage/dirsync/) or by provisioning\naccounts using an [external authoritative\nsource](/architecture/identity/overview-google-authentication#external_authoritative_source). For example, you could set up account\nprovisioning with [Microsoft Entra ID](/architecture/identity/federating-gcp-with-azure-active-directory) or [Active Directory](/architecture/identity/federating-gcp-with-active-directory-introduction).\n\nTo learn more about federation using Cloud Identity or\nGoogle Workspace, see [Single sign-on](/architecture/identity/single-sign-on).\n\n### Workforce Identity Federation\n\nWorkforce Identity Federation lets you use an external identity provider (IdP)\nto authenticate and authorize a workforce---a group of *users* , such as employees,\npartners, and contractors---using IAM, so that the users can\naccess Google Cloud services. With Workforce Identity Federation you don't\nneed to synchronize user identities from your existing IdP to Google Cloud\nidentities, as you would with Cloud Identity's [Google Cloud Directory Sync\n(GCDS)](https://tools.google.com/dlpage/dirsync/).\nWorkforce Identity Federation extends Google Cloud's identity\ncapabilities to support syncless, attribute-based single sign-on.\n\nTo learn more about Workforce Identity Federation, see\n[Workforce Identity Federation overview](/iam/docs/workforce-identity-federation).\n\nWhat's next\n-----------\n\n- Learn about the ways to [authenticate to Google APIs with user\n credentials](/docs/authentication#user-accounts).\n- Learn how to [grant users access to resources](/iam/docs/granting-changing-revoking-access)."]]
