How to Provision Google Workspace Cloud Identity Free for Vendors

The Licensing Dilemma

In a modern corporate environment, your company likely relies on Google Workspace for email, but you also rely on Google Workspace as your primary Identity Provider (IdP) via SAML or OIDC. When an employee wants to log into Salesforce, Slack, or a custom internal dashboard, they click “Sign in with Google.”

This works perfectly for full-time employees who possess a paid Google Workspace license (e.g., Enterprise Plus at $30/month). However, a significant problem arises when you need to grant access to an external vendor, a freelance contractor, or a janitorial staff member. These individuals do not need a corporate Gmail inbox or 2TB of Google Drive storage; they simply need a secure, authenticated identity to log into your HR portal or ticketing system.

Purchasing a full $30/month Workspace license just to give a vendor login credentials is a massive waste of the IT budget. The correct architectural solution is to provision Google Cloud Identity Free.

What is Cloud Identity Free?

Cloud Identity Free is a hidden, zero-cost licensing tier within the Google Workspace ecosystem. It allows you to create a standard Google account within your corporate domain (e.g., [email protected]). This account has a secure password, it enforces your corporate 2-Step Verification (2SV) policies, and it can authenticate via SAML to any third-party app.

Crucially, a Cloud Identity Free user has zero access to Gmail and zero access to Google Calendar. Because they consume no core Google services, Google provides these licenses completely free of charge, up to a massive limit (typically 50,000 users).

Step 1: Enabling Cloud Identity Free

You must explicitly activate this subscription within your tenant; it is not enabled by default alongside standard Workspace.

1. Log into the Google Workspace Admin Console using Super Administrator credentials.
2. Navigate to Billing > Get more services.
3. On the left-hand menu, select Cloud Identity.
4. Locate the Cloud Identity Free block and click Get Started.
5. Proceed through the checkout wizard. The total cost will clearly state $0.00.

Step 2: Disabling Automatic Workspace Licensing

By default, Google Workspace is often configured to automatically assign your most expensive license to every new user you create. If you do not disable this, your vendors will accidentally consume your paid licenses.

1. Navigate to Billing > License settings.
2. Ensure the setting for your primary Workspace license is set to Off (Do not automatically assign).

Step 3: Creating the Vendor Account

You can now safely create the account for your external contractor.

1. Navigate to Directory > Users and click Add new user.
2. Fill out their name and set their email address (e.g., [email protected]).
3. Click Add New User.

Step 4: Assigning the Free License

Finally, you must bind the zero-cost license to the user so they can actively authenticate.

1. Click on the newly created user in the directory to open their profile.
2. Scroll down to the Licenses section and click on it.
3. You will see your standard Workspace licenses, and you will now see Cloud Identity Free.
4. Toggle Cloud Identity Free to the ON position.
5. Click Save.

The vendor can now securely log into your corporate SSO portals. If they attempt to navigate to mail.google.com, they will be greeted with a hard Google error stating that they do not possess a license for Gmail, ensuring your corporate communication channels remain strictly isolated to paid employees.