Best Buy Enhances Cloud Security and User Management with Workforce Identity Federation

Best Buy's venture into deeper cloud integration with Google has led to significant improvements in both security and user management. As the retailer expanded its utilization of Google Cloud for advanced analytics and AI, it encountered a couple of pivotal challenges: effectively managing risk and handling the administrative complexities when synchronizing thousands of backend users from Microsoft Entra ID.

To tackle these issues, Best Buy adopted Google Cloud's Workforce Identity Federation. This strategy enabled developers to securely access cloud resources using their existing Microsoft credentials, without necessitating a separate identity management system. Such a shift gave technical leaders renewed confidence in controlling access, ensuring it remains both manageable and auditable at scale.

Eliminating Service Account Dependencies

Traditionally, Best Buy relied on intricate synchronization pipelines to port backend user data from Entra ID into Google Cloud. However, due to the company's structure, which involved using Cloud Identity without deploying Google Workspace, a more straightforward solution was necessary. Previously, the integration of Best Buy's Power BI with BigQuery relied heavily on service account credentials.

A system based on service account keys might work efficiently on a small scale, yet becomes increasingly vulnerable and cumbersome as the user base expands. With the responsibility of manually rotating these keys, the security and platform teams faced daily challenges. Every key required tracking, each one potentially compromising security and creating friction in data access.

To accommodate a huge number of users, Best Buy revamped its identity architecture. By implementing Workforce Identity Federation, the company directly federated Entra ID identities into Google Cloud. Now, developers authenticate themselves as individuals when accessing BigQuery through Power BI, eliminating the need for key rotations and reducing security concerns associated with credentials shared over various communication channels.

Architecture Overview

The streamlined architecture hinges on a collaborative framework between Entra ID and Workforce Identity Federation. Entra ID manages the authentication process, while Workforce Identity Federation establishes the trust needed between the two systems. Notably, this framework is stateless on Google's end, verifying tokens during access rather than syncing user data, which alleviates many credential management duties.

The accompanying diagram illustrates how identity flows from Entra ID through Workforce Identity Federation to the services utilized by Best Buy. The fundamental alteration from prior methodologies is the complete removal of the service account key layer, leading to a system without credentials to manage between Entra ID and Google Cloud.

Critical Implementation Strategies

During the transition, Best Buy made substantial technical decisions that aided in the implementation of the new architecture:

• Distinct Provisioning and SSO Applications: Best Buy followed best practices by keeping the provisioning application separate from the single sign-on (SSO) application in Entra ID. This clear separation allows independent updates without impacting the other application.

• Organizational Unit Considerations: The provisioning service account was assigned to a dedicated organizational unit (OU) where SSO was explicitly disabled, preventing any initial authentication problems.

• Understanding Stateless Interaction: By recognizing that Workforce Identity Federation does not create or maintain user records in Cloud Identity, Best Buy ensured that their new architecture could scale efficiently, free from synchronization delays and outdated records.

Enhanced Security for Developers

For developers, the transition was largely transparent. They log in once using their corporate Entra ID credentials, and access to BigQuery operates automatically, whether via Power BI or direct API calls. The SSO experience is consistent across all tools tied to their Microsoft identity.

The operational advantages for security and platform teams are notable. There’s a diminished attack surface due to the removal of credential management, and audit logs now reflect individual user actions instead of shared service accounts. Access can be quickly revoked based on user lifecycle events rather than waiting for slow manual interventions.

Organizations still managing service account keys for Google Cloud access should consider adopting Workforce Identity Federation. Not only does it bolster security, but it also streamlines operations as teams grow. Best Buy is currently expanding this implementation to enhance access for an even larger workforce to optimize its future operations.

Future of Identity Federation

Google Cloud aims to simplify the integration of various identity providers. Recent updates facilitate easier setups for Ping Identity users and enable access to online billing accounts.

• New Setup for Ping Identity: Organizations using Ping Identity can now refer to a new, tailored setup guide for establishing secure federation with Google Cloud.

• Support for Online Billing: Google Cloud now offers support for clients with online billing accounts, allowing for secure, synchronization-free access without mandating an enterprise billing agreement.

Take the Next Step

With a focus on reducing obstacles to cloud adoption, Google Cloud is determined to make it easier for organizations to enhance their security environments. To explore these new functionalities and connect your organization's identity provider, examine how Workforce Identity Federation facilitates direct identity federation, and check out the supported Google Cloud services.