About user and device policies

You can let some people in your organization use a feature or service in their managed Google account, but not others. You can also tailor settings for different Chrome devices. 

	Set up your organizational structure To get started, place any departments, teams, or Chrome devices that have special requirements, in organizational units. After that, apply your desired settings, as described in the sections below. Get started: How the organizational structure works
	Turn services on or off for different users For example, allow only your support team to use Meet by placing them in an organizational unit that has Meet turned on.  Go to: Turn a service on or off for Google Workspace users
	Change service settings for different users Most services have individual settings that you can apply to organizational units. For example, allow only the sales team to share calendars publicly by placing them in an organizational unit that has public sharing turned on. Go to: Change service settings for different users
	Apply policies to different Chrome devices You can add Chrome devices to organizational units, too. For example, to let teachers use Incognito mode on their Chromebook but not students, create an organizational unit containing the teachers' Chromebooks. Then in your Devices settings, turn on Incognito mode for just that organization. Go to: Change settings for different Chrome devices
	Advanced options for large organizations If you manage a large number of users or sync your LDAP directory, you might want to make exceptions for some groups of users, regardless of their organizational unit.  For example, you might turn off YouTube for everyone in the engineering department, except for a few members who need it turned on. You have 2 options: Customize service settings using configuration groups Customize service access using access groups