These steps do not require a local federation, such as Active Directory Federation Services (ADFS).

The Azure directory holds your domain as a registered subdomain.

User account names are the same for Azure and Google.Your domain is configured in Azure and Google (Workspace or Cloud Identity).However, because a user is signing in to a device, there are several additional considerations. Signing in is very similar to signing in to a Google Workspace account from a browser via SAML SSO. Their passwords can remain within your organization's Identity Provider (IdP). Security Assertion Markup Language (SAML) single sign-on (SSO) support for ChromeOS devices allows users to sign in to a device with the same authentication mechanisms that you use within the rest of your organization.

Then, your users can sign in to an Azure authentication page instead of the Google sign-in screen on their ChromeOS devices. As an admin, you can set up user provisioning and single sign-on (SSO) between a Microsoft Azure Active Directory (AD) tenant and your Google Workspace or Cloud Identity account.

Azure active directory sign in