Best Buy expanded its use of Google Cloud for advanced analytics and AI but faced scaling challenges: mitigating risk and managing administrative friction when syncing thousands of backend users from Microsoft Entra ID.

The retailer solved both by implementing Google Cloud’s Workforce Identity Federation, allowing developers to access cloud resources securely using their existing Microsoft credentials without a separate identity store.

This eliminated service account keys, which had become a liability as the team grew.

Previously, Best Buy maintained complex synchronization pipelines and relied on service account credentials for Power BI integration with BigQuery.

Manually rotating keys created friction and security vulnerabilities.

The new architecture uses Entra ID for authentication and Workforce Identity Federation to broker the trust relationship, validating tokens at access time rather than syncing user records.

This stateless federation removes the credential management burden.

Key implementation decisions included: separating provisioning and SSO apps in Entra ID to avoid configuration conflicts, placing the Entra ID provisioning service account in a separate OU with SSO disabled to prevent bootstrapping issues, and understanding that syncless means Google-side statelessness, eliminating synchronization lag and stale records.

For developers, the change was invisible—they authenticate once with corporate credentials and access BigQuery automatically.

For security and platform teams, benefits include reduced attack surface, audit logs showing individual users instead of shared service accounts, and quick access revocation based on enterprise identity lifecycle.

Best Buy is scaling this secure access to a broader workforce.

Google Cloud has also expanded Workforce Identity Federation support with a dedicated setup guide for Ping Identity users and support for online billing accounts, making it easier for organizations to bring their own identity providers without needing an enterprise billing agreement.