54 Cloud Identity Free decoy accounts

A user account on a free Cloud Identity seat, named to look high-value — an ex-CFO, an svc-backup identity — left discoverable where an attacker enumerates (the directory, a stale group, an old document ACL) and used by nobody. Any successful login or password-recovery attempt against it is hostile by definition, so an activity rule on its login events can page immediately with no false-positive budget to manage.

Caveats

A decoy with real group memberships stops being a tripwire and becomes an attack path¹
Cloud Identity Free seats are capped²
The login-alert rule needs only basic activity-rule creation (AND filters, up to 5 conditions),…³

Setup steps

open ↗
https://admin.google.com/ac/users · captured 2026-07-15
Directory › Users › Add new user
Create a decoy user on a Cloud Identity Free seat with a name that looks high-value but is never used (e.g. an ex-CFO or a 'svc-backup' identity).

License = Cloud Identity Free; long random password; 2SV enrolled but never used

Add an account for a new user ↗
Leave the decoy discoverable where an attacker enumerates: leave it visible in the directory (contact sharing is an organization-wide Directory setting — №39; scope per-OU visibility with a custom directory if needed), add it to a plausibly stale group, and list it on an old shared doc ACL.

Contact sharing on (organization-wide Directory setting; per-OU visibility via custom directories); member of a plausible stale group; listed on an old doc ACL

Turn Directory on or off ↗
open ↗
https://admin.google.com/ac/ax · captured 2026-07-15
Rules › Create rule › Activity
Create an activity rule on user log events scoped to the decoy user — ANY successful login or password-recovery attempt is by definition hostile.

Condition: user log event (login) AND user
decoy
Severity
High
Action
alert center + page

Create and manage activity rules ↗ User log events ↗
Verify with GAM that the decoy carries no real group memberships or Drive access that could turn it into an actual foothold.
```
gam info user decoy@…
gam print groups member decoy@…
```

Ongoing maintenance

requires a human Quarterly: keep decoys plausible — aged profile photos, group memberships, mail traffic patterns.

How to verify

Attempt a sign-in against a decoy account from a clean browser and confirm the alert fires and routes to the monitored address.

v0.1.3Detectedition All (free seats) policy #30 · #33 ↗