Organizational policies FAQ

Help me understand

Why define an organizational structure?

You should define an organizational structure only if you want to customize services access or settings for different users or devices. For details, see About user and device policies.

Do I have to define an organizational structure?

No. If you don't define an organizational structure, all settings you make in your Google Admin console apply equally for all users and devices.

Does the organizational structure impact how quickly users are added?

Yes. If you're adding more than 50K users, it's best to keep your organizational structure as simple and as flat as possible to improve the performance of account creation. A simple organizational structure is especially important if you need to add many users as quickly as possible. You can always create a deeper organizational hierarchy later.

Are organizational units related to domains?

No. A user's organizational unit determines which services and features are available to that user. A user's domain determines their account username and email address (if they're using Gmail). If you want to apply policies to users in a particular domain, you can place those users in their own organizational unit. But you don't have to. An organizational unit can include users from different domains. And users in a domain can be distributed across any number of organizational units.

Are organizational units the same thing as access groups?

No. An organizational unit determines which services and features are available to a set of users.

An access group turns on a service for users within an organizational unit. You can turn off a service for the organization, and then add specific users to an access group that has the service turned on.

Must organizational units match our corporate LDAP structure?

No. The organizational structure in your Admin console only controls which services and features are available to users. You can build this structure to match your LDAP structure if you want to, but you don't have to.

If you do want to replicate your LDAP organization in your Admin console's organizational structure, you can do so using our Google Cloud Directory Sync tool.

How it works

How do I add users to organizational units?

You can add a user to an organizational unit when you create their account. You can also later move a user to another organizational unit.

Can all settings be customized for organizational units?

Not at this time. Settings for most paid services can be customized by organizational unit, but for some services, settings must apply the same for all users. Google recognizes the need to control other settings but this level of granularity is not yet available. 

Can I customize settings for a single user?

Yes. To customize service access for a single user, create an organizational unit containing just that user.

Can I create administrators for specific organizational units?

Yes. You can assign an administrator who has a User management role to perform actions only on users in specific organizational units. For details, see see Assign user management roles.

What happens to a user's data if their access to a service is turned off? (Google Workspace only) 

If a user has created Google Docs, Sheets, Slides, or Sites and subsequently does not have access to these services, their content remains in the system, still accessible by the administrator and any users the content was shared with.

Was this helpful?
How can we improve it?
Clear search
Close search
Google apps
Main menu
Search Help Center