The problem focuses on securing "super administrator accounts for the organization" when Cloud Identity is synced with Microsoft Entra ID and uses Entra ID for SSO. The key requirements are the principle of least privilege and strong authentication.
Principle of Least Privilege & Dedicated Accounts: Google's best practices strongly recommend creating dedicated, non-federated accounts for super administrators that are distinct from regular user accounts. These accounts should only be used for super administrator tasks and not for daily activities. This segregation ensures that the highest privilege accounts are isolated and adhere to the principle of least privilege by not having combined responsibilities.
Extract Reference: "Designate Organization Administrators... We recommend keeping your super admin account separate from your Organization Administrator group." and "Give super admins a separate account that requires a separate login. For example, user alice@example.com could have a super admin account alice-admin@example.com." and "Use the super admin account only when needed. Delegate administrator tasks to user accounts with limited admin roles. Use the least privilege approach..." (Google Cloud Documentation: "Super administrator account best practices | Resource Manager Documentation" - https://cloud.google.com/resource-manager/docs/super-admin-best-practices)
Strong Authentication (Google 2-Step Verification): Even when using a third-party identity provider like Microsoft Entra ID for most users, Google recommends enforcing Google's own 2-Step Verification for the critical super administrator accounts. This provides a "break-glass" mechanism that is independent of the external IdP. If the Entra ID integration were to fail or become compromised, the Google-managed super administrator accounts, protected by Google's own 2SV, would still be accessible for emergency recovery.
Extract Reference: "Even when using the legacy SSO profile, super admins can't sign in with SSO in these cases: Admin console. When super administrators try to sign in to an SSO-enabled domain via admin.google.com, they must enter their full Google administrator account email address and associated Google password (not their SSO username and password), and click Sign in to directly access the Admin console. Google doesn't redirect them to the SSO sign-in page." (Google Cloud Identity Help: "Super administrator SSO" - https://support.google.com/cloudidentity/answer/6341409) - This highlights that super admin accounts can bypass SSO for direct Admin console access, making Google 's 2SV crucial.
Extract Reference: "It's especially important for super admins to use 2SV because their accounts control access to all business and employee data in the organization. Protect your business with 2-Step Verification. Use security keys for 2-Step Verification." (Cloud Identity Help: "Security best practices for administrator accounts" - https://support.google.com/cloudidentity/answer/9011373)
Options C and D are incorrect because combining "organization administrator" (IAM role for GCP resources) and "super administrator" (Google Workspace/Cloud Identity domain-level control) privileges violates the principle of least privilege. Option A is less secure than B because relying solely on Entra ID's 2SV for super administrators means a compromise of Entra ID or an outage would leave the Google Cloud organization vulnerable without an independent break-glass mechanism.
