Initially in your Google Admin console, all your users and devices are placed in a single organizational unit, called the top-level organizational unit. All settings you make in the Admin console apply to this top-level organizational unit and, therefore, to all users and devices in your account.
Apply settings to groups of users or devices
To apply different settings to some users or devices, place them in a child organizational unit, (for example, Finance, Human Resources) below the top level. Users or devices in organizational units get the settings that you apply to them. To keep a child organizational unit from inheriting its parent’s settings, apply to the child any settings that are specific to it.
- Example—Gmail, Google Meet, and Google Drive work for users in the top-level organizational unit. Users in the child organizational unit inherit Gmail and Drive, but for them, Meet is off.
- Recommendation—Create separate organizational units for users and devices. That way, you can tailor settings for managed devices and managed users as needed.
Set up your organization
Below the top-level unit, you can add as many organizational units as you want—either at the same level or in a hierarchy. When you change a setting at a higher level, the settings for all child organizational units that inherit that setting also change. Custom settings, however, remain unchanged.
Apply settings to one user or device
To change settings for a single user or device, create an organizational unit for just that user or device. A user or device belongs to only one organizational unit and inherits that organizational unit's settings.
Options for large companies
If you manage a large number of users or sync your LDAP directory, use access groups to turn on a service for specific users within an organizational unit. For example, you turned off YouTube for all organizational units, but some users in the marketing and sales organizational units need the service. Two options:
- Move the users to a new or existing organizational unit and then turn on the service.
- Add the users to an access group that has the service turned on.
Each user in the group can access the service, even when the service is turned off for their organizational unit or the users are in different organizational units. With access groups, you can turn on services for users without changing your organizational structure.
For information about how to use access groups, go to Use groups to customize service access.
If you use multiple domains
You can mix and match users from all your domains in an organizational unit. To change settings for users in a particular domain, create an organizational unit for just those users.
Best practices
- To apply different settings to a set of users or to Chrome devices, create a child organizational unit. For more information, go to How to create a new organizational unit.
- For more information on adding users to an organizational unit, go to Move users to an organizational unit.
- You can turn on and off services for users in organizational units. For more information, go to Control access for organizational units.
- Enrolled devices in your organization go in the top-level organizational unit. To apply different settings to a set of Chrome devices, place them in their own organizational unit. For more information, go to Move a Chrome device to an organizational unit.
- You can customize the service settings for users in organizational groups. For more information, go to Change service settings for different users.
