Best Buy Ditches Service Account Keys for Secure AI Access

Best Buy is scaling its AI workloads on Google Cloud, but with thousands of backend users, managing access was becoming a swamp of credential rot and administrative friction. The retailer’s solution? Ditch the service account keys and let developers authenticate directly with their existing Microsoft Entra ID credentials via Workforce Identity Federation.

This move is like clearing a choked channel—suddenly, the water flows freely. No more manual key rotation, no more wondering who ran that query in BigQuery. Audit logs now show individual users, not shared service accounts. For the security team, it’s like swapping a leaky boat for a sturdy capybara raft.

From Sync Pipes to Direct Federation

Best Buy previously ran complex synchronization pipelines to copy users from Entra ID to Google Cloud. Their Power BI integration with BigQuery relied on service account credentials—a pattern that works at small scale but becomes a liability as your team grows. Each key was a potential vulnerability, and rotating them created daily friction.

Now, developers authenticate as themselves using their Entra ID identity. Workforce Identity Federation brokers the trust relationship statelessly—no user records are synced, just tokens validated at access time. This eliminates synchronization lag, stale records, and separate provisioning pipelines.

Key Implementation Decisions

• Separate provisioning and SSO apps in Entra ID: Running them as two distinct enterprise apps provides cleaner separation of concerns.
• Place the automation OU carefully: The provisioning service account goes in a separate OU with SSO disabled to avoid a bootstrapping problem.
• Understand syncless means stateless: Workforce Identity Federation doesn’t create user records in Cloud Identity—it validates tokens at the moment of access.

What This Means for Developers

For developers, the change was practically invisible. They authenticate once through their corporate credentials, and access to BigQuery works automatically—whether through Power BI or direct API calls. The SSO experience matches everything else they access through their Microsoft identity.

For security teams, the benefits are huge: the attack surface from credential management disappears, audit logs show individual users, and access can be revoked instantly based on enterprise identity lifecycle.

Expanding Federation Support

Google Cloud is making it easier for all organizations to bring their own identity providers. Recent updates include a dedicated setup guide for Ping Identity users and support for online billing accounts, so you don’t need an enterprise billing agreement to use Workforce Identity Federation.

If you’re still managing service account keys for developer access to Google Cloud, it’s time to consider this approach. Best Buy is scaling this secure access to a broader workforce to power its future retail operations—and you can too.

For more on how to federate identities directly, check out Workforce Identity Federation and explore supported Google Cloud services.

Original announcement published on Google Cloud.