What are Google Workplace Organizational Units, and how do they work?

A Google Workplace Organizational Unit (OU) is a grouping of users a super administrator creates in the Google Admin console with a distinct set of access settings and permissions. Administrators can set up different organizational units and add users based on their job roles and the apps they need access to. Google OUs are a way of managing administrative information and tasks within Google tools and are used to create departments, teams, projects, and other organizations with a common purpose.

Those unfamiliar with Google OUs may have seen other organizational/hierarchical charts like the hard copy governmental organizational chart above. The primary benefit of using Google OUs is that, in addition to showing the layout of an organization as a traditional chart does, OUs also allow an administrator to efficiently assign specific access rights and privileges to users who belong to those org units.

Take, for instance, the chart above. The Education department/org unit may need access to Google Classroom, while the Parks and Recreation department/org unit does not. In a private company example, employees in a “Marketing — Digital” org unit could be granted access to Google Ads Manager on a company device, while members of the “Finance — Accounting” org unit could be restricted from sharing sensitive Google Drive files. This helps ensure that each OU has appropriate access levels without compromising overall security across the organization. Additionally, administrators can use org units to manage shared resources among teams; for example, by allocating shared cloud storage space among different departments.

What’s the difference between Google Organizational Units vs. Google Groups?

The most significant difference between Google OUs and Groups is that an Organizational Unit is tied to your organization’s structure and a Google (access) Group allows you to provision different access to users without adjusting your organizational hierarchy. Thus, while a user can only belong to a single OU, they can belong to multiple access groups. For example, while the four users shown below are a part of four respective Google OUs, they’re all able to be a part of the “Pawnee City Government” access group. We at Crosswire recommend using OUs for your broader organizational structure and access groups to administer more particular policies.

How to create a new Google OU

To create a new OU in Google Workspace, you must log into your Google Admin console at admin.google.com. Once logged in, click on the dropdown for the Directory tab, which can be found on the left-hand side of the page. Then, navigate to Organizational units and click on the blue Create organizational unit phrase in the top right. You will then be prompted to enter a name and description for your new OU. After you have entered this information, click the Create button, and you’ve created your new group!

Different policies that can be enforced with Organizational Units

Context-Aware Access:

Context-Aware Access controls what apps users can access based on context, such as whether they’re using a company device or where they are. This allows you to create granular security policies based on attributes such as device security, identity, and IP address. To deploy Context-Aware Access, go to Security > Access and data control > Context-Aware Access and click Turn On. You can use Context-Aware Access for various enforcement tactics like IP address enforcement, device policy enforcement, and managed Chrome browser enforcement. For even more tips on Context-Aware Access, check out Google’s guide here.

💡 Note: When deploying Context-Aware Access, ensure you don’t deprovision users’ access to communication tools like Gmail or Google Chat so that they can communicate with you (and vice versa) no matter their context.

Service control (turn a service on or off for certain users):

The most straightforward way to turn a service on or off for a group of users is to control it by organizational unit. For example, you may need Google Earth turned on for the Education, Library, and Parks and Rec departments but not the Sewage department (or need Google Pay turned on for your Marketing team but not the rest of your company). You can find specific instructions for each app’s service control here, but in general, Apps > Additional Google services houses most Google Workspace apps. Here you can click on the app you wish to adjust permissions for and then click the Service Status to turn access on or off for each organizational unit (as shown below).

Final tips for using Google Workplace Org Units effectively

• Create and leverage hierarchy structure appropriately (check out this Tech Funnel blog for more information on how to do this in general)
• Keep in mind that a user can only be in one OU at a time, so you’ll need to think in terms of hierarchies very early on in order to set things up correctly
• Google Groups are more flexible and easier for administering policies, so usually, you only want to use OUs as a tool for broad strokes organization
• Be aware that Google Group maintenance gets unwieldy very quickly, and you’ll want to be clear on who’s responsible for the groups

For further guidance on securing your organization, reach out to us! You can stay up to date with / join Crosswire below.