About user and device policies

Options for ​Google Workspace​ & Cloud Identity admins

You can let some people in your organization use a feature or service in their managed Google account, but not others. You can also tailor settings for different Chrome devices. 

Set up your organizational structure

To get started, place any departments, teams, or Chrome devices that have special requirements, in organizational units. After that, apply your desired settings, as described in the sections below.

Get started: How the organizational structure works

Turn services on or off for different users

For example, allow only your support team to use Meet by placing them in an organizational unit that has Meet turned on. 

Go to: Turn a service on or off for Google Workspace users

Change service settings for different users

Most services have individual settings that you can apply to organizational units. For example, allow only the sales team to share calendars publicly by placing them in an organizational unit that has public sharing turned on.

Go to: Change service settings for different users

Apply policies to different Chrome devices

You can add Chrome devices to organizational units, too. For example, to let teachers use Incognito mode on their Chromebook but not students, create an organizational unit containing the teachers' Chromebooks. Then in your Devices settings, turn on Incognito mode for just that organization.

Go to: Change settings for different Chrome devices

Advanced options for large organizations

If you manage a large number of users or sync your LDAP directory, you might want to make exceptions for some groups of users, regardless of their organizational unit.  For example, you might turn off YouTube for everyone in the engineering department, except for a few members who need it turned on.

You have 2 options:

Was this helpful?

How can we improve it?
Clear search
Close search
Google apps
Main menu