Best Buy adopts Google Cloud federation for developers

Best Buy has adopted Google Cloud's Workforce Identity Federation for developer access to its cloud systems, replacing an earlier model that used service account credentials for some Google Cloud access.

The retailer made the change as it expanded its use of Google Cloud for advanced analytics and artificial intelligence, while seeking to reduce risk and ease the administrative burden of managing large numbers of backend users from Microsoft Entra ID.

Under the new arrangement, developers use their existing Microsoft Entra ID credentials to access Google Cloud resources, including BigQuery through Power BI, instead of relying on separate service account keys. Users now authenticate as individuals, changing how access is controlled and logged.

Best Buy had previously maintained synchronisation pipelines to copy backend users from Entra ID into Google Cloud. That approach became harder to manage as the number of users and data access requirements grew, particularly because the retailer used Cloud Identity without deploying Google Workspace.

The earlier setup used service account credentials for Power BI connections to BigQuery. At smaller scale, that model worked, but it required teams to rotate keys manually and track which credentials each team held.

It also gave security teams limited visibility into individual activity because audit trails often pointed to shared service identities rather than named staff. Removing the service account key layer reduced the burden of credential management and improved auditability.

The system uses Entra ID for authentication, while Workforce Identity Federation acts as the trust broker between Microsoft's identity platform and Google Cloud. Instead of synchronising and storing user records on Google's side, the federation model validates tokens at the point of access.

That stateless approach is central to the design. It avoids synchronisation lag, eliminates stale record clean-up, and removes the need for separate provisioning pipelines, making the architecture suitable for an environment expected to support tens of thousands of users.

Implementation choices

Several technical decisions shaped the rollout. One was separating provisioning and single sign-on applications in Entra ID, running them as two distinct enterprise applications so changes in one area would not affect the other.

Another was placing the Entra ID provisioning service account in a separate organisational unit and disabling single sign-on for that unit. That prevented a bootstrapping problem in which a globally enforced single sign-on policy could stop the provisioning account from authenticating during setup.

For developers, the change was designed to be largely invisible. Staff authenticate once with corporate Entra ID credentials and then reach BigQuery automatically, whether through Power BI or direct application programming interface calls.

For security and platform teams, the effects are more operational. Access can be revoked through the existing enterprise identity lifecycle rather than waiting for key rotation, and audit logs now identify individual users instead of a shared service account.

The project also reflects a wider shift in how large organisations manage cloud access for internal technical teams. As analytics, AI, and cloud-based data platforms spread across larger workforces, identity management has become a more prominent operational issue, especially for companies trying to avoid duplicated directories and separate credential stores.

Google also used the announcement to outline broader support for Workforce Identity Federation beyond Best Buy's deployment. It has introduced a dedicated setup guide for Ping Identity users and extended support for customers with online billing accounts, allowing them to use the federation model without an enterprise billing agreement.

The expansion suggests Google is trying to make the product relevant to a wider range of organisations with different identity systems and billing arrangements. In practice, the pitch is that companies can connect their existing identity provider directly to Google Cloud services without synchronising users into a separate Google-managed identity layer.

Best Buy is now extending the model to a broader section of its workforce as it builds out its cloud estate for retail operations. Removing service account keys means developers no longer need to rotate credentials, worry about exposed keys in chat messages, or guess who performed an action in the audit log.