Structure Your Organization and Manage Profiles

Learning Objectives

After completing this unit, you'll be able to:

• Set up Organizational Units (OUs) in Google Workspace.
• Control access to Google services via OUs.
• Manage profiles in Google Workspace.

Create Organizational Units

In this exercise, you create two Organizational Units (OUs) and move your users into the appropriate OU based upon their role in the company.

1. If you’re not already signed in, sign in to your domain as the administrator at admin.google.com.
2. From the menu (top left) select Directory > Organizational units.
3. Click the yellow circle with the + sign to create a new OU.
4. Give the OU the name of Executive and click Create.
5. Create another OU following 2–4 above, and name it Employees.
6. Navigate to your users list. You should see the two new OUs on the left-hand side beneath the top-level organization.
7. Select Alex, Lars, Samantha, and Timothy by checking the box to the left of their name in the user list.
8. Click More > Change organizational unit, and select Executive. Then click Continue.
9. Click Change to confirm the move.
10. Repeat Steps 7–9, but this time move Ellie, Jon, Tom, and Will to the Employees OU.
11. Review the options in the column to the left of your user list. Here you can see all users, and you can now refine (or filter) the users by OU. Practice filtering by checking Users from selected organizational units and picking from the list below to refine the list. Notice how you can select one or many OUs.

Restrict Access to a Google Workspace Service

One benefit of applying an organizational structure like this is that you can now enable and disable services at an OU level. Child OUs normally inherit settings from above, but it’s also possible to override inheritance at the OU level providing for greater flexibility.

Read through the scenario, and then go through the steps to complete the exercise.

You receive this email from the CEO.

Hello AwesomeAdmin,

Alex advised me of a Google service called Takeout that allows users to export their data from Google Workspace. Is it possible to enable this service for our executives only but restrict access to our employees?

Regards,

Sam Morse, CEO

Google Takeout is an additional Google service that is enabled by default for all users in the organization, so you must disable the service for all users in the Employees OU.

1. If you’re not already signed in, sign in to your domain as the administrator at admin.google.com.
2. From the menu (top left) select Apps > Additional Google services.
3. On the left-hand side click your top-level organization.
4. Scroll down the list of services. Hover over Google Takeout and click the 3 dots icon at the end of the row. Then click Off (Override).
5. Click Turn off to confirm the change. This disables the service for everyone in your organization. We must now enable the service for your Executive OU.
6. On the left-hand side, click the Executive OU.
7. Scroll down the list of services, and locate the Google Takeout service. Notice that the service is OFF. This setting has been inherited from the top-level organization. Hover over Google Takeout and click the 3 dots icon at the end of the row. Then click On (Override).
8. Click Turn on to confirm the change. Users in the Executive OU now have access to Google Takeout. Users in the root organization and any other child OU cannot use the service.

As with setting up OUs in general, changes can take 24 hours to propagate to all users.

Manage Google Workspace Profiles

Now that you’re familiar with managing organizations. Let’s home in on managing individual user profiles. This is done via the Google Workspace Directory.

First, let’s ensure contact sharing is enabled for your organization.

1. If you’re not already signed in, sign in to your domain as the administrator at admin.google.com.
2. From the menu (top left) select Directory > Directory settings.
3. Click Sharing settings.
4. Ensure that Enable contact sharing is selected. If it is disabled, enable it now.
   In this section you can also specify which information is shared. For example, you can choose whether to show or hide email aliases. And if you have multiple domains in your organization, you can share the entire directory across all domains or restrict sharing to the domain level only (that is, users in one domain only see other users in that same domain).
5. Click Save if you have made any changes.

As an administrator you can add information such as phone numbers, secondary email addresses, and location details to a user’s profile. You can edit profiles individually in the admin console, or you can use the Admin SDK API or a third-party product. You can also use GCDS to update user profiles. Finally, you can also allow users to update some profile information themselves.

In the following scenario, you’re tasked with updating user profiles.

You receive the following email from Lars Ericsson, the HR manager.

AwesomeAdmin,

You may recall that we recently hired Jon Baird. He used to work as a contractor, but as he is now a full-time employee, can you update his job title to be HR business partner?

In addition, I understand that Google Workspace allows users to update some aspects of their own profile. I see no reason why our users should not be allowed to do this. Can you please enable this feature? Thanks!

Regards, 

Lars Ericsson, HR Manager

Let’s start by updating Jon’s job title.

1. If you’re not already signed in, sign in to your domain as the administrator at admin.google.com.
2. Click the Users icon.
3. Locate Jon Baird in the list, and click his name, then click the User information card.
4. Click anywhere in the Employee information section. You can now edit this section.
5. Change Jon’s Job title to HR Business Partner and click Save.

Now let's ensure users can update their own profiles.

1. Select Directory > Directory settings from the left-hand menu.
2. Click Profile editing.
3. By default, users can change their Birthday and Work location from their About me page. Check all other fields so that users can also update their Name, Photo, and Gender.
4. Click Save.

Adding work location information is recommended as this allows Google Calendar to make smart room recommendations based upon the user’s location. If you decide to complete your employee ID information (and you are not using SSO or 2SV) you can use these IDs as a login challenge to help protect your user accounts when Google suspects that an unauthorized person is trying to access a user’s account.

Customize Directories

You receive the following email from Lars Ericsson, the HR manager.

Hey AwesomeAdmin,

We are about to commence a new project and will be installing a new expenses system. A consultant will be joining us for a month or so to help us implement the new system and train our users.

While here, he will need to have a Google Workspace account so we can collaborate on project documents, and so forth. Can you create the following account?

We would also like to keep our company directory information confidential from contract staff. Can you restrict visibility so that Mark can only see users involved on the project? Please ensure that he can look up my details and Jon Baird as he will be leading the implementation on our behalf. Thanks.

Regards, 

Lars Ericsson, HR Manager

There are a number of steps you must complete to fully satisfy the request.

Custom directories are applied to an OU, so let’s start by creating an OU.

1. If you’re not already signed in, sign in to your domain as the administrator at admin.google.com.
2. From the menu (top left) select Directory > Organizational units.
3. Click the yellow circle with the + sign to create a new OU.
4. Give the OU the name of Contractors and click Create.

Now you need to create Mark’s account.

1. Click the Users icon.
2. Click Add new user.
3. In the dialog box that appears, create and account for Mark Jones as follows:
   1. First name: Mark
   2. Last name: Jones
   3. Primary email: mark.jones@yourdomain
   4. Organizational unit: Contractors (use the pencil icon on the right to select the correct OU)
   5. Password: hellohello1
   6. Ensure the Ask for a password change at the next sign-in option is enabled to ensure Mark changes his password when he first signs into his account.
4. Click Add new user to create the account.
5. Click Done.

Now, create a Google Group. Custom directories use Google Groups to determine which user information to display. So we must create a Google group before we create the custom directory.

 From the menu (top left) select Directory > Groups.

1. Click Create group.
2. Enter the following Group details:
   1. Name: HR Project
   2. Description: Custom directory group for HR
   3. Group email: hrproject
3. Click Next.
4. Choose Team as the access type and click Create group.
5. Click the Add members to HR Project link, then click the yellow circle with a + sign to add members.
6. Enter Mark’s email address and also add Lars and Jon.
7. Click Add to group. You should now see all three users listed as members of the group. Hover over Lars and click the down arrow in the Role column, and select Manager to make Lars the group’s manager.
8. Click Save.

The final step is to define the custom directory.

1. From the menu (top left) select Directory > Directory settings.
2. Click Visibility settings.
3. Select Contractors from the list of OUs on the left-hand side of the page.
4. Change the Directory visibility to Users in a custom directory.
5. Click Create new and enter a name for the new directory of HR Project.
6. In the Search for a group field, add the HR Project group.
7. Click Create.
8. In the Choose a custom directory field, select HR Project and click Override.
9. Notify Lars that you have fulfilled his request, and don’t forget to provide him with Mark’s password.

Congratulations you have just added a custom directory to your organization!

Resources

• Video: Use Domain Shared Contacts API to Add External Contacts
• Google Workspace Admin Help: Add an organizational unit
• Google Workspace Admin Help: Modify the organizational structure
• Google Workspace Admin Help: Move users to an organizational unit
• Google Workspace Admin Help: Turn a service on or off for Google Workspace users
• Google Workspace Admin Help: Turn Directory on or off
• Google Workspace Admin Help: Add information to a user’s Directory profile
• Google Workspace Admin Help: Let Directory users change their photo and profile information
• Google Workspace Admin Help: Add employee ID as a login challenge
• Google Workspace Admin Help: Customize a directory for a team or group