Security Migration: GCP IAM and Governance to Azure¶

A hands-on guide for security architects, ISSOs, and platform engineers migrating GCP identity, governance, encryption, and monitoring services to Azure equivalents.

Scope¶

This guide covers:

• Cloud IAM to Entra ID + Azure RBAC
• Service accounts to Managed Identities
• Data Catalog to Purview
• Cloud DLP to Purview sensitivity labels
• Cloud KMS to Key Vault
• VPC Service Controls to Private Endpoints + NSGs
• Cloud Audit Logs to Azure Monitor
• Security Command Center to Defender for Cloud

For federal-specific compliance (FedRAMP, IL4/IL5, CMMC), see Federal Migration Guide.

Architecture overview¶

flowchart LR
    subgraph GCP["GCP Security"]
        GIAM[Cloud IAM]
        GSA[Service Accounts]
        GDC[Data Catalog]
        GDLP[Cloud DLP]
        GKMS[Cloud KMS]
        GVPC[VPC Service Controls]
        GAUD[Cloud Audit Logs]
        GSCC[Security Command Center]
    end

    subgraph Azure["Azure Security"]
        EID[Entra ID + RBAC]
        MI[Managed Identities]
        PV[Microsoft Purview]
        PSL[Purview Sensitivity Labels]
        KV[Azure Key Vault]
        PE[Private Endpoints + NSGs]
        AM[Azure Monitor]
        MDC[Defender for Cloud]
    end

    GIAM --> EID
    GSA --> MI
    GDC --> PV
    GDLP --> PSL
    GKMS --> KV
    GVPC --> PE
    GAUD --> AM
    GSCC --> MDC

Cloud IAM to Entra ID + Azure RBAC¶

Conceptual mapping¶

Role mapping for analytics¶

IAM migration steps¶

1. Export GCP IAM policy bindings: gcloud projects get-iam-policy PROJECT_ID --format=json
2. Map GCP principals to Entra ID identities (users, groups, managed identities)
3. Map GCP roles to Azure RBAC roles (table above)
4. Create Entra ID security groups mirroring GCP group structure
5. Assign Azure roles at appropriate scope (management group, subscription, resource group, resource)
6. Configure Unity Catalog grants for Databricks-level access
7. Validate access with test queries and operations

Conditional Access (replacing IAM Conditions)¶

GCP IAM conditions restrict access based on attributes (resource tags, request time, IP). Azure uses Conditional Access policies (for user sign-in) and ABAC (for data plane):

Service accounts to Managed Identities¶

GCP service accounts are Google-managed identities for non-human workloads. Azure Managed Identities serve the same purpose but eliminate credential management entirely.

Migration example¶

GCP:

# Service account with BigQuery access
gcloud iam service-accounts create sa-finance-dbt \
    --display-name="Finance dbt service account"

gcloud projects add-iam-policy-binding acme-gov \
    --member="serviceAccount:sa-finance-dbt@acme-gov.iam.gserviceaccount.com" \
    --role="roles/bigquery.dataEditor"

# Generate key file (security risk: key can be exfiltrated)
gcloud iam service-accounts keys create key.json \
    --iam-account=sa-finance-dbt@acme-gov.iam.gserviceaccount.com

Azure:

# User-assigned managed identity (no key file needed)
az identity create \
    --name umi-finance-dbt \
    --resource-group rg-analytics

# Assign Storage Blob Data Contributor role
az role assignment create \
    --assignee $(az identity show --name umi-finance-dbt --resource-group rg-analytics --query principalId -o tsv) \
    --role "Storage Blob Data Contributor" \
    --scope "/subscriptions/.../storageAccounts/stfinance"

# Assign Unity Catalog grants via Databricks SQL
# GRANT MODIFY ON SCHEMA finance TO `umi-finance-dbt`;

Key advantage: No key file to manage, rotate, or risk leaking. The managed identity authenticates to Azure services automatically.

Data Catalog to Microsoft Purview¶

GCP Data Catalog provides metadata management and search. Microsoft Purview is significantly richer, covering unified catalog, data governance, sensitivity labeling, lineage, and compliance.

Migration steps¶

1. Export Data Catalog entries and tag templates
2. Create Purview classification rules matching GCP tag templates
3. Configure Purview data sources (ADLS, Databricks, Fabric)
4. Run automated scans to discover migrated assets
5. Apply classifications and glossary terms
6. Validate lineage appears for ADF and dbt pipelines

Cloud DLP to Purview sensitivity labels¶

GCP Cloud DLP inspects and redacts sensitive data. Purview sensitivity labels provide equivalent capabilities plus integration with Microsoft 365.

CSA-in-a-Box classification taxonomies¶

CSA-in-a-Box ships four classification taxonomies that cover common federal sensitive data types:

• PII: csa_platform/csa_platform/governance/purview/classifications/pii_classifications.yaml
• PHI: csa_platform/csa_platform/governance/purview/classifications/phi_classifications.yaml
• Government: csa_platform/csa_platform/governance/purview/classifications/gov_classifications.yaml
• Financial: csa_platform/csa_platform/governance/purview/classifications/financial_classifications.yaml

Map GCP DLP InfoTypes to these taxonomies:

Cloud KMS to Azure Key Vault¶

Migration steps¶

1. Inventory all KMS key rings, keys, and their usage
2. Create Key Vault instances (one per environment or workload)
3. Generate equivalent keys in Key Vault
4. Update storage account encryption to use Key Vault keys (CMEK)
5. Update Databricks workspace to use Key Vault for encryption
6. Configure auto-rotation policies
7. Decommission GCP KMS keys after confirming all data re-encrypted

VPC Service Controls to Private Endpoints + NSGs¶

GCP VPC Service Controls create a security perimeter around GCP services to prevent data exfiltration. Azure uses a different but equivalent model based on Private Endpoints and Network Security Groups.

Implementation pattern¶

Azure VNet
├── Subnet: snet-databricks
│   └── Private Endpoint: pe-databricks
├── Subnet: snet-storage
│   └── Private Endpoint: pe-storage
├── Subnet: snet-keyvault
│   └── Private Endpoint: pe-keyvault
└── NSG: nsg-analytics
    ├── Allow: VNet-to-VNet
    ├── Allow: On-prem VPN
    └── Deny: Internet inbound

Key difference: VPC SC is perimeter-based (wrap multiple services in one boundary). Azure Private Endpoints are per-service. The Azure model is more granular -- each service has its own network endpoint.

Cloud Audit Logs to Azure Monitor¶

CSA-in-a-Box audit chain¶

CSA-in-a-Box implements a tamper-evident audit chain (CSA-0016) that provides stronger FedRAMP High AU-family evidence than GCP Cloud Audit Logs out of the box:

• Immutable log storage with cryptographic chaining
• Cross-service audit correlation
• Automated compliance evidence generation
• NIST 800-53 AU control family coverage

GCP audit data to preserve¶

Before decommissioning GCP, export and archive:

• Cloud Audit Logs (Admin Activity, Data Access)
• IAM policy history
• VPC Service Controls perimeter history
• Cloud Monitoring alert history
• Incident response records

These become evidence in post-migration compliance audits.

Security Command Center to Defender for Cloud¶

Multi-cloud advantage¶

Defender for Cloud supports multi-cloud monitoring, including GCP. During the migration bridge phase, you can monitor both GCP and Azure resources from a single Defender for Cloud dashboard.

Identity federation during migration¶

During the migration bridge phase, workloads on Azure may need to access GCP resources (and vice versa). Use federated identity:

Azure to GCP (bridge phase)¶

Azure Managed Identity
  --> Federated Identity Credential (GCP)
    --> GCP Workload Identity Federation
      --> Access GCS / BigQuery during bridge

GCP to Azure (bridge phase)¶

GCP Service Account
  --> Workload Identity Federation (Azure)
    --> Entra ID app registration
      --> Access ADLS / Databricks during bridge

Validation checklist¶

After migrating security:

• All GCP IAM bindings mapped to Azure RBAC assignments
• Service accounts replaced with Managed Identities (no key files)
• Purview scans discovering all migrated assets
• Sensitivity labels applied to sensitive data (PII, PHI, CUI)
• Key Vault keys encrypting storage and compute
• Private Endpoints configured for all data services
• Azure Monitor receiving diagnostic logs from all services
• Defender for Cloud showing clean security posture
• GCP audit logs archived for compliance evidence
• Unity Catalog grants matching original BigQuery access patterns

Last updated: 2026-04-30 Maintainers: CSA-in-a-Box core team Related: Federal Migration Guide | Complete Feature Mapping | Migration Playbook