CSE enforces zero trust on the SaaS applications that Google Workspace brokers via IdP Federation — Google Workspace delegates sign-in to the CSE policy engine, which validates device trust and zero trust policy before authentication completes.

• IdP Federation — federate Google Workspace to CSE so device trust is validated at sign-in, across all applications Google brokers.