Organizations that own multiple Internet domains can associate their domains with a single Google Apps account and manage them from a single Google Admin console. Users from different domains preserve their original email addresses, but all users are on the organization's global address list, and all users can share calendars, Google Drive files, Sites, and videos with anyone in the entire organization.

For example, Acme Corp is an apparel company that has acquired multiple brands. Internally, Acme Corp wants to manage its users as one organization, so all employees can share documents and calendars. When its brand spokesmen interact with people outside the company, they want to use email addresses with their individual brand identity. (Learn more)

When you sign up for Google Apps, you give the name of the Internet domain for your organization. This domain name becomes the primary domain associated with your Google Apps account. The primary domain has a special status regardless of whether you add additional domains. (Learn more about choosing your primary domain and limitations with non-primary domains.)

You add domains on the Domain settings tab of the Google Admin console. You must verify ownership of each domain you add, just as you do for the primary domain. (Learn more)

A Google Apps account can include up to 600 domains.

A domain alias is an alternate name for a single domain, containing the same set of users. A user bob@acme.com will automatically get the alias of bob@acme.alias.com when a domain alias is created. Those two addresses must belong to the same user. With separate domains, bob@acme.com and bob@acme.alias.com can be two different users. (Learn more)

Domains and organizational units are independent ways to organize your users. There is no inherent relationship between them. If your organization has two domains, you can create two organizational units corresponding to the domains but you do not have to. An organizational unit can include users from different domains. For example, you might have a Marketing organizational unit containing users with email addresses in both domains. (Learn more about organizational units.)

Yes. As long as the SSO system is configured to identify the user by email address, it works smoothly for Google Apps accounts with multiple domains. (Learn more about SSO.)

Google recognizes this need, but merging accounts is not available at this time. (Learn more about the limitations of multiple domain support.)

Google Apps consists of a variety of services, such as Gmail, Google Calendar, Google Chat, Google Drive, and Google Sites. The administrator for an organization can control which of these services are available to users. The administrator can also divide users into organizational units and specify which services are available to users in each unit.

For example, suppose you want to restrict access to Google Chat for most users, but want to turn it on for users in the Support group. You would create a Support organizational unit, turn on Chat for the organizational unit, and add the Support users to the organizational unit. You turn Chat off for all other parts of the organization. (Learn more about controlling user access to services.)

You only need to define an organizational structure if you want to provide different services to different users. If all your users have access to the same services, you do not need to make any changes.

At this time, you can only control which Google Apps services are available. All other settings apply to all users, regardless of which organizational unit they belong to. Google recognizes the need to control other settings, such as the ability to chat outside of your organization, but this level of granularity is not yet available.

You can add users to organizational units when you create the user accounts or move existing users to organizational units. There are a few different options for adding users, all of which support assigning each user to an organizational unit.

The organizational structure you define in Google Apps may or may not be the same as your corporate organizational structure or the structure embodied in your LDAP server. The Google Apps organizational structure controls only which services are available to which users. If users’ access to Google Apps services follows from which department they report into, the Google Apps organizational structure matches the corporate structure. However, it does not need to.

At a programmatic level, Google Apps uses the Google APIs rather than LDAP. However, we have updated Google Apps Directory Sync so that you can replicate the Organizational Unit structure from your LDAP server to Google Apps.

They are not related. Each user has a primary email address in one domain and belongs to one organizational unit, but the domain and the organizational unit are independent. If your organization has two domains, you can create two organizational units corresponding to the domains but you do not have to. An organizational unit can include users from different domains, and the users in a domain can belong to any number of different organizational units.

No. Every user belongs to a single organizational unit, but can belong to any number of groups. A user's organizational unit determines which services are available to that user. A user's group membership determines which group emails the user receives.

Not at this time. You can control access to all Google-developed products.

Service access is determined at the level of an organizational unit. To control service access for a single user, create an organizational unit containing just that user.

For details on how to create administrators and what privileges can be granted, please see Give a user administrator privileges.

If a user has created Google Docs, Sheets, Slides, or Sites and subsequently does not have access to these services, their content remains in the system, still accessible by the administrator and any users the content was shared with.

If you turn off a user's access to Gmail, however, the user's Gmail account and its contents are expunged after 20 days.