Google Workplace Organizational Units (OUs) according to Parks and Rec
What are Google Workplace Organizational Units, and how do they work?
A Google Workplace Organizational Unit (OU) is a grouping of users a super administrator creates in the Google Admin console with a distinct set of access settings and permissions. Administrators can set up different organizational units and add users based on their job roles and the apps they need access to. Google OUs are a way of managing administrative information and tasks within Google tools and are used to create departments, teams, projects, and other organizations with a common purpose.
Those unfamiliar with Google OUs may have seen other organizational/hierarchical charts like the hard copy governmental organizational chart above. The primary benefit of using Google OUs is that, in addition to showing the layout of an organization as a traditional chart does, OUs also allow an administrator to efficiently assign specific access rights and privileges to users who belong to those org units.
Take, for instance, the chart above. The Education department/org unit may need access to Google Classroom, while the Parks and Recreation department/org unit does not. In a private company example, employees in a “Marketing — Digital” org unit could be granted access to Google Ads Manager on a company device, while members of the “Finance — Accounting” org unit could be restricted from sharing sensitive Google Drive files. This helps ensure that each OU has appropriate access levels without compromising overall security across the organization. Additionally, administrators can use org units to manage shared resources among teams; for example, by allocating shared cloud storage space among different departments.
What’s the difference between Google Organizational Units vs. Google Groups?
The most significant difference between Google OUs and Groups is that an Organizational Unit is tied to your organization’s structure and a Google (access) Group allows you to provision different access to users without adjusting your organizational hierarchy. Thus, while a user can only belong to a single OU, they can belong to multiple access groups. For example, while the four users shown below are a part of four respective Google OUs, they’re all able to be a part of the “Pawnee City Government” access group. We at Crosswire recommend using OUs for your broader organizational structure and access groups to administer more particular policies.
How to create a new Google OU
To create a new OU in Google Workspace, you must log into your Google Admin console at admin.google.com. Once logged in, click on the dropdown for the Directory tab, which can be found on the left-hand side of the page. Then, navigate to Organizational units and click on the blue Create organizational unit phrase in the top right. You will then be prompted to enter a name and description for your new OU. After you have entered this information, click the Create button, and you’ve created your new group!
Different policies that can be enforced with Organizational Units
Context-Aware Access controls what apps users can access based on context, such as whether they’re using a company device or where they are. This allows you to create granular security policies based on attributes such as device security, identity, and IP address. To deploy Context-Aware Access, go to Security > Access and data control > Context-Aware Access and click Turn On. You can use Context-Aware Access for various enforcement tactics like IP address enforcement, device policy enforcement, and managed Chrome browser enforcement. For even more tips on Context-Aware Access, check out Google’s guide here.
💡 Note: When deploying Context-Aware Access, ensure you don’t deprovision users’ access to communication tools like Gmail or Google Chat so that they can communicate with you (and vice versa) no matter their context.
Service control (turn a service on or off for certain users):
The most straightforward way to turn a service on or off for a group of users is to control it by organizational unit. For example, you may need Google Earth turned on for the Education, Library, and Parks and Rec departments but not the Sewage department (or need Google Pay turned on for your Marketing team but not the rest of your company). You can find specific instructions for each app’s service control here, but in general, Apps > Additional Google services houses most Google Workspace apps. Here you can click on the app you wish to adjust permissions for and then click the Service Status to turn access on or off for each organizational unit (as shown below).
Final tips for using Google Workplace Org Units effectively
- Create and leverage hierarchy structure appropriately (check out this Tech Funnel blog for more information on how to do this in general)
- Keep in mind that a user can only be in one OU at a time, so you’ll need to think in terms of hierarchies very early on in order to set things up correctly
- Google Groups are more flexible and easier for administering policies, so usually, you only want to use OUs as a tool for broad strokes organization
- Be aware that Google Group maintenance gets unwieldy very quickly, and you’ll want to be clear on who’s responsible for the groups
More from our blog
A comprehensive timeline and breakdown of the October 2023 Okta Support Case Management System breach.
In light of October 2023 Okta support compromise, Crosswire sent the following message to its customers.
The term Identity Threat Detection and Response (ITDR) has gained significant popularity this year, but what is ITDR, actually?
CISOs Chris Castaldo and Tanner Randolph share insights on security maturity and identity in the enterprise.
Whether this is your 1st or 21st time at Black Hat, these tips can help you weather a jam-packed and intense week.
False positives are a huge problem in security: see what Crosswire is doing to prevent them and mitigate their effects.
We've made the modern identity stack entirely too convoluted and broken, but not for the reasons you think.
How are you protecting your accounts before an incident can occur (or slowing an incident down before it really ramps up)?
This is Solution 2: Remediate of a two-part series on how to detect and remediate evolving identity threats.
This is Solution 1: Detect of a two-part series on how to detect and remediate evolving identity threats.
Explore the historical use, modern approaches, and future applications of AI in detection and response (D&R).
If you’re looking for the right time to join a high-risk, high-reward venture, we’d argue that there’s never been a better opportunity.
IT security audits can be a pain for everyone involved: check out our solutions to make this auditing season just a little bit easier.
RBAC lacks sophistication and flexibility, failing to address the access needs of the modern company.
Who owns identity at your org? Identity is (and should be treated as) a co-owned problem between security and IT.
Yep, you heard that right; we at Crosswire believe that your Okta groups should be as empty as possible.
Crosswire, and its co-founders Johnny and Nick, are building the future of enterprise identity in new and exciting ways.
The theme for 2023’s RSA Conference™ is “Stronger Together.” When info security is more important than ever, so is collaboration.
It’s no secret that your IT organization is crucial to your company. But are they getting all of the resources they need?
Why cybersecurity is more crucial than ever and what you can do to make your organization more secure, no matter your role.
Five significant ways to improve your workflows with automation and get more results than your resources permit.
Crosswire’s technical usability guide to Okta Lifecycle Management (LCM), from onboarding to offboarding.
Subscribe to our blog
Get Crosswire's security insights delivered straight to your inbox. No frills, no spams, unsubscribe anytime!