A capability that lets an organization’s people access Google Cloud with the credentials of an external identity provider (such as Microsoft Entra ID or Okta), without syncing or duplicating their accounts in Cloud Identity.
On the ACE it is distinguished from Workload Identity Federation: "workforce" is for people and "workload" is for applications and workloads. Typical question: employees on Entra ID who must use the console without Cloud Identity accounts.
Workforce Identity Federation is a concept that can show up on the exam. Check the full guide to see it in context.