Best Buy adopts Google Cloud Workforce Identity Federation for AI workloads

Addressing Scaling Challenges

As Best Buy expanded its use of Google Cloud for advanced analytics and AI, its technology teams encountered challenges related to mitigating risk and managing administrative friction. These issues arose from syncing thousands of backend users from Microsoft Entra ID to Google Cloud.

Implementing Workforce Identity Federation

Best Buy resolved these scaling challenges by implementing Google Cloud's Workforce Identity Federation. This solution allows developers to access cloud resources securely using their existing Microsoft credentials, removing the need for a separate identity store. This approach provides strict control, auditability, and manageability at scale for technical leadership.

Replacing Service Accounts

Historically, Best Buy maintained complex synchronization pipelines to copy backend users from Entra ID to Google Cloud. The organization previously relied on service account credentials for integrations like Power BI with BigQuery. This method became a liability as the team grew, requiring manual key rotation and presenting potential security vulnerabilities.

Modernized Identity Architecture

To support tens of thousands of users, Best Buy modernized its identity architecture by adopting Workforce Identity Federation. This federates existing Entra ID identities directly into Google Cloud. Developers now authenticate as themselves using their Entra ID identity when accessing BigQuery through Power BI, eliminating issues with key rotation, exposed credentials, and unclear audit logs.

Stateless Federation

The new architecture involves Entra ID handling authentication, while Workforce Identity Federation brokers the trust relationship with Google Cloud. This federation is stateless on Google's side, validating tokens at the moment of access without syncing user records. This significantly reduces the burden of credential management by removing the service account key layer.