Best Buy scales AI workloads and secures access with Workforce Identity Federation

Replacing service accounts with direct federation Best Buy historically maintained complex synchronization pipelines to copy backend users from Entra ID to Google Cloud. Because the organization used Cloud Identity without a Google Workspace deployment, it needed a more direct approach. Previously, Best Buy's Power BI integration with BigQuery relied on service account credentials.

This pattern can work at a small scale, but quietly becomes a liability as your team grows. Manually rotating keys for service accounts meant tracking the credentials each team held, and accepting that every key was a potential security vulnerability. Service account keys created daily friction for the Best Buy security and platform teams, and the technical debt compounded as data access requirements grew more complex.

To support tens of thousands of users, Best Buy modernized its identity architecture. The team adopted Workforce Identity Federation to federate existing Entra ID identities directly into Google Cloud. Now, when developers access BigQuery through Power BI, they authenticate as themselves using their existing Entra ID identity.

They no longer need to rotate keys, worry about credentials exposed in chat messages, or guess who performed an action in the audit log. The architecture relies on two components working together: Entra ID handles authentication, Workforce Identity Federation brokers the trust relationship between Entra ID and Google Cloud. This federation is stateless on Google's side.

It validates tokens at the moment of access instead of syncing user records. Removing the service account key layer greatly reduces the credential management burden. Architecture The diagram below shows how identity flows from Entra ID through the Workforce Identity Federation to the services teams use at Best Buy.

The key change from the previous approach is the removal of the service account key layer entirely; there is no credential to manage between Entra ID and Google Cloud. Identity flows from Entra ID through the Workforce Identity Federation to the services teams use at Best Buy Key implementation decisions When implementing this architecture, Best Buy made several important technical choices: Separate provisioning and SSO apps in Entra ID: The configuration follows the Entra ID provisioning and single sign-on (SSO) setup guide. You should separate the provisioning application from the SSO application in Entra ID.

Running them as two distinct enterprise apps provides a cleaner separation of concerns; provisioning changes do not affect SSO configuration, and vice versa. Place the automation OU carefully: You need to place the Entra ID provisioning service account in a separate organizational unit (OU) and explicitly disable SSO for that OU. This prevents a bootstrapping problem: If you enforce SSO globally, the provisioning account cannot authenticate to set up the provisioning in the first place.

Understand that syncless means stateless on Google's side: Workforce Identity Federation does not create or maintain user records in Cloud Identity. It validates tokens at the moment of access. This makes the architecture viable for Best Buy's target scale, because it eliminates synchronization lag, stale record cleanup, and separate provisioning pipelines.