# 1.1 Ensure Corporate Login Credentials Are Used (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000232870-1-1-ensure-corporate-login-credentials-are-used-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: Level 1 ### Description: It is recommended to use corporate login credentials instead of personal or consumer accounts (e.g., Gmail accounts) for accessing Google Cloud resources. Corporate accounts enhance visibility, enable better auditing, and provide centralized control over access to Cloud Platform resources. ### Rationale: Using corporate-managed accounts ensures that access to resources is aligned with the organization's policies. Personal accounts outside the organization's domain can pose risks, including unauthorized access, lack of audit trails, and challenges in enforcing security controls. By mandating corporate credentials, organizations can ensure consistency in access management, improve compliance, and reduce potential security vulnerabilities. ### Impact: Managing corporate accounts may require additional administrative overhead. While this may not significantly affect smaller organizations, it can become more complex as the organization grows in size. ### Default Value: By default, no external email addresses are granted access to the organization’s Google Cloud resources. However, consumer accounts can still be added to IAM policies unless restricted by an organization policy. ### Remediation: Test Plan: ##### Using Google Cloud Console 1. Log in to Google Cloud Console [at Google Cloud Console](https://console.cloud.google.com/). 2. In the left-hand menu, go to IAM & Admin > IAM. ![](https://support.icompaas.com/assets/kb/b6058ad0198c0e7e.png) 3. Check the Members column in the IAM page for email addresses. 4. Identify any external accounts (e.g., @gmail.com or @yahoo.com) that do not belong to your corporate domain (e.g., @yourcompany.com). ![](https://support.icompaas.com/assets/kb/032cebbbfe420de8.png) 4. Switch to other projects by selecting the project dropdown at the top and repeat the process for all projects. ##### Using Google Cloud CLI 1. Run the following command to list IAM policies for a specific project: (Replace PROJECT\_ID with your project ID) gcloud projects get-iam-policy PROJECT\_ID  2\. To list IAM policies for a folder, run: (Replace FOLDER\_ID with your folder ID) gcloud resource-manager folders get-iam-policy FOLDER\_ID 3. Run this command to retrieve the organization’s IAM policies: (Replace ORGANIZATION\_ID with your organization ID) gcloud organizations get-iam-policy ORGANIZATION\_ID 4. In the output, check for any accounts outside your corporate domain (e.g., @gmail.com or @yahoo.com). ### Implementation: ##### Using Google Cloud Console 1. Remove Unauthorized Accounts: -   Navigate to IAM & Admin > IAM.     **![](https://support.icompaas.com/assets/kb/ebb722de5d48c837.png)** - Click the edit icon **(pencil) next to the role of an unauthorized account.**                   **![](https://support.icompaas.com/assets/kb/6b89b572ac1cb67e.png)** - **Click** Remove **to delete the external account.**                    **![](https://support.icompaas.com/assets/kb/8fe7d213b0ce9d19.png)** - **Confirm the changes.**                     **![](https://support.icompaas.com/assets/kb/56a2eab111352165.png)** 2. Add Corporate Accounts: - Click the Add button.                  **![](https://support.icompaas.com/assets/kb/660ed7f0f6809180.png)** - **Enter the email address of the corporate account (e.g., user@yourcompany.com).** - **Assign the appropriate role.** - **Click** Save. 3. Repeat for All Projects: - **Switch to other projects in the dropdown and repeat the steps above.** ##### **Using Google Cloud CLI** Remove Unauthorized Accounts: **Run the following command to remove an unauthorized account:** gcloud projects remove-iam-policy-binding PROJECT\_ID \\ --member="user:UNAUTHORIZED\_EMAIL" \\ --role="ROLE" **Replace:** - **PROJECT\_ID with the project ID.** - **UNAUTHORIZED\_EMAIL with the email of the external user.** - **ROLE with the role assigned to that user.** Add Authorized Corporate Accounts: **To add a corporate account, run:** gcloud projects add-iam-policy-binding PROJECT\_ID \\ --member="user:CORPORATE\_EMAIL" \\ --role="ROLE" **Replace:** - **PROJECT\_ID with the project ID.** - **CORPORATE\_EMAIL with the corporate email address.** - **ROLE with the appropriate role for the user.** **Repeat for Folders and Organization: Use similar commands for folders and organizations:** Folders: gcloud resource-manager folders remove-iam-policy-binding FOLDER\_ID \\ --member="user:UNAUTHORIZED\_EMAIL" \\ --role="ROLE" Organizations: gcloud organizations remove-iam-policy-binding ORGANIZATION\_ID \\ --member="user:UNAUTHORIZED\_EMAIL" \\ --role="ROLE" ## Backout Plan: Step 1: Revert Account Removal If an account was removed by mistake, re-add it: gcloud projects add-iam-policy-binding PROJECT\_ID \\ --member="user:RESTORED\_EMAIL" \\ --role="ROLE" Step 2: Review IAM Logs - Use IAM audit logs to identify removed users and access changes: gcloud logging read "protoPayload.methodName='google.iam.admin.v1.SetIamPolicy'" --limit 10 Step 3: Temporarily Allow External Accounts (If Necessary) - Disable Domain Restricted Sharing (only temporarily): gcloud org-policies disable-enforce iam.allowedPolicyMemberDomains --organization=ORG\_ID - **Re-enable it after restoring access:** gcloud org-policies enable-enforce iam.allowedPolicyMemberDomains --organization=ORG\_ID **Step 4: Notify Users & Adjust Policies** - **Communicate access restoration to impacted users.** - **Adjust IAM policies to ensure only necessary accounts have permissions.** ### **References:** **[](https://support.google.com/work/android/answer/6371476)**     1. [Google Support - Corporate Account Management](https://support.google.com/work/android/answer/6371476)     [2. gcloud projects get-iam-policy](https://cloud.google.com/sdk/gcloud/reference/projects/get-iam-policy)     3. gcloud folders get-iam-policy     4. [gcloud organizations get-iam-policy](https://cloud.google.com/sdk/gcloud/reference/organizations/get-iam-policy)[](https://cloud.google.com/resource-manager/docs/organization-policy/restrictingdomains)     [5. Restricting Domains in IAM](https://cloud.google.com/resource-manager/docs/organization-policy/restrictingdomains)[](https://cloud.google.com/resource-manager/docs/organization-policy/org-policyconstraints)     [6. Organization Policy Constraints](https://cloud.google.com/resource-manager/docs/organization-policy/org-policyconstraints)[](https://cloud.google.com/resource-manager/docs/organization-policy/org-policyconstraints)**[](https://cloud.google.com/resource-manager/docs/organization-policy/org-policyconstraints)[](https://cloud.google.com/resource-manager/docs/organization-policy/org-policyconstraints)[](https://cloud.google.com/resource-manager/docs/organization-policy/org-policyconstraints)** ### ** CIS Controls:**

Control

Description

IG 1

IG 2

IG 3

5.6 Centralize Account Management

Use a centralized directory or identity service to manage accounts and control access to resources.

✅

✅


16.2 Configure Centralized Authentication

Ensure authentication is managed through as few centralized systems as possible for better security.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.