Our company uses Microsoft 365 for email and identity, but the web team relies heavily on Google Ads, Analytics, Search Console, and Tag Manager. Over time, people created several separate Gmail accounts without going through IT. I don't have access to all of them, which creates a serious continuity and security problem if someone leaves the company. What's the best way to bring these accounts under centralized company control?
4 Answers
At a minimum, inventory every existing account and the services, properties, and campaigns attached to it. Move ownership to managed company accounts, add more than one trusted administrator, and remove personal Gmail addresses from recovery and billing settings. Don’t rely on collecting passwords, since users can change them and former employees may still retain access.
A company Google Workspace setup, federated with Microsoft 365 as the identity provider, is the cleanest long-term arrangement. Create managed accounts for the staff who need Google tools, assign access based on job requirements, and make sure administrative ownership and recovery methods belong to the organization rather than individual users.
Set up Google Cloud Identity and sync it with Microsoft Entra ID. Users can then access the Google services they need with their normal corporate accounts through SSO, while the company retains administrative control. There’s some setup work initially, but it gives you proper lifecycle management when employees join, change roles, or leave.
Federating Google with Entra ID is another solid approach. Create managed Google identities using employees’ business addresses, have Entra handle authentication, and keep the recovery and administrative controls with the company. Existing accounts and assets can be migrated over gradually rather than all at once.
Google Cloud Identity has free options that are usually enough for governing access to these services, so you don’t necessarily need to buy full Google Workspace licenses for everyone.