burger icon to open nav

Why we need organisational units and groups

Organisational units and groups are two of the main features of the Workspace infrastructure. They allow us to separate each department and to work together as a team.

Both these features are accessed via the admin panel. If you’re following these guides in chronological order, this is part three of the Workspace admin guide.

Create a Workspace for business account using the 14 day free trial Intro to the admin panel: upgrade, downgrade and delete your account

What are Workspace organisational units?

Organisational units are a way to separate our company’s different departments. Each unit can have different privileges and access to different features.

Without them everyone in the company would have the same features. While this may be okay for some, we still need to be aware of them when adding users.

What are Workspace groups?

Groups allow teams to collaborate on single files or the entire contents of folders as a team. When an email is sent to a group, all group members receive it. Likewise when sharing folders and files,

Groups aren’t just for small teams. Each department can have it's own group. Likewise everyone in the company can be added to a group, one single email can then be directed at everyone in the company.

How to separate you company into different organisational units

We must have at least one organisational unit (OU). Named after our account, this was created for us when we set up our account. Later we can rename this to something shorter. To save any ambiguity I prefer “root”, but more on this shortly.

The reason I prefer creating OUs before adding users, is that otherwise, when bulk uploading users we have to add them to the root OU. then move them into the unit after we create it.

also : when adding new users individually we can add them to an organisational unit at the same time. Providing of course that we’ve already created one

How to access Workspace organisational units

Although not initially visible, our org units are accessible from the admin home page. Once you’re there, scroll to the bottom and click Show more. There you’ll see a collection of direct links to further features

Section of the Workspace admin homepage showing aaccess to Orgamizational units

Clicking the organisational units box will open up the relevant tab showing a list of all our units and a + sign to add more. I’ll return to this after I’ve renamed the existing one.

List of organisational units showing the top level unit

How to rename an organisational unit

As the image shows, I have one unit with the company name. To avoid error, I prefer single word names for my units. So let’s start by changing its name.

As it's the main parent unit, which will contain all the others, I’m going to rename it “root”. We do this by hovering over the unit and clicking the three dot icon on the right. Then Edit

This will open a new dialogue box where we can edit the unit name and description. As the image below shows, I’ve edited both

Popout that appears when hovering over am organisational unit giving the option to edit

How to create a new organisational unit

You may already have an idea of the units you want to create. These can be determined by departments or groups of users who have, or don’t have. Access to specific applications.

Note: users cannot be part of more than one OU, but can be moved from one to another. So I’ll begin by clicking the yellow button near the top containing the plus sign.

Popout allowing editing of organisational unit

Of the two fields in the box that appears, only the name is required. The description is optional. I’m going to name my new unit as “accounts”. It then appears in the organisational units’ listing under its parent folder.

List of organisational units showing the top level unit and two more

I’m going to repeat the above process to create a few more. As OUs can be deleted or renamed, I’m not going to concern myself too much with the naming.

Nested organisational units

Organisational units can contain other OUs. We can do this either by stipulating the parent folder when we create it, or by hovering over the intended parent org and clicking on the add icon to the right of the listing.

List of organisational units showing how to add a nested unit

Note in the above image the yellow circle for adding units is at the bottom. This is because I’ve collapsed my browser while taking the screenshot.

As the image below shows, nested units will then appear under their parent in the listings.

Crganisational listings showing nested units

Organisational unit paths

There are times, such as when bulk uploading users, when we need to add the org unit path. The root folder path is defined as “/”.

A direct child of the root folder would be something like “/marketing”. While the path of a child of the marketing org would be something like “/marketing/research”

Turning services on and off for organisational units

Admins can determine which apps, such as Chat and Meet, each organisational unit can access. By default, all of them are turned on. However: we can override this setting.

Child OUs inherit the settings of their parent OU. For example: if we turned a service off for the root OU, then it will be turned off for everyone. There’s two ways we can approach this, depending on policy.

If you have many OUs but only want a specific service to be available to one or two, first turn it off at root level, then back on for only those who need it.

When the opposite is true, and we only want to turn it off for one or two, leave it turned on at root level then turn it off for those you want to deny access.

We don’t access this feature from the organisational units console. Instead we apply access permissions from the apps console,

How to access the app settings

The apps are accessible from several places, the most direct route being from the admin home page by clicking the more dropdown as we did when accessing OUs. This presents us with a view of the features shown in the image below.

Note: once again I’ve collapsed my browser for the sake of the screenshot. If you’re on a desktop, you’ll see a single row of four and a side panel.

Workspace apps and services console

The one we’re interested in is the first, titled Google Workspace and concerns the core applications

Admin area where apps can be turned on and off for different organisational units

As you can see in the image, the service status is turned on for everyone. Notice the organisational units to the left of the apps list and how I’ve got the root OU view.

Any adjustments I make here will apply to all OUs. if I wanted to target a specific OU, I would click on the OU to the left, then apply the settings.

Creating groups and setting restrictions

Groups for business, as the name suggests, is only available to business plan users. Groups provide a means of collaboration, reaching many people with a single email, and giving people access to services that have been turned off at the organisational level.

Groups are one of the features that can be turned on and off by admins. Currently they are turned on by default. Turning them on and and off is done in the same way as when applying app settings to organisational units

While still on the subject: of app settings, admins can turn on features that are turned off at the OU level. However: they cannot turn them off.

This is a useful feature if you don’t want an entire OU access to one of the core features. Simply turn it off at OU level, create a group with the people who do need access, then turn the app on for the group.

Who can create groups is set by admins according to company policy. This could be everyone in the company, one or more organisations, or only admins.

Here;s a few reasons I commonly use for setting up groups. Remember: each group has its own email address, and that an email sent to the group reaches all group members inbox.

  • Allow teams to work together on projects
  • For each department to allow easier communication
  • For the entire company to deliver such things as circulars
  • Admins to keep each other informed of policy updates

Now we know what groups can be used for, let’s have a look at Groups for Business in the admin area, alternatively: in the side panel on the left, click Apps and in the dropdown click Overview.

We’re actually heading to the core features, so click on the first box titled Workspace. Then in the list of apps clich Groups for Business.

In the Groups for Business homepage, you’ll note that each section has a dropdown arrow to the right. Open the one up titled Share settings

List of organization units showing a nested unit

The first section concerns who can access the group. I’ll briefly cover that at this point because I'm fairly sure it's still in the early stages of development.

The main focus is on who can create groups and a couple of settings which the group owners can override.

The options for who can create groups are:

  • Only organisation admins can create groups
  • Anyone in the organisation can create groups
  • Anyone on the internet can create groups

Why the option for anyone on the internet can create groups is even there, is a mystery. Personally I think it would be inviting trouble.

The options where, if allowed by admin but overridden by the group owner are:

  • Group owners can allow external members
  • Group owners can allow incoming email from outside the organisation

Unless it's a company policy, I prefer to allow these and leave it up to the owner’s discretion.

Optionns in Workspace admin for who can create groups

The final section deals with who can view conversations, we have a choice of 5 options for this and two for hiding the them in the directory

  • Owners only
  • Owners and managers
  • All group members
  • All organisation users
  • anyone on the internet
Default settings for permissions to view conversations

Don’t forget to click Save at the bottom whenever you make changes here.

The section on who can view messages refers to conversations between group members, I a type of mini forum. To be honest this is a train wreck, at least in its current state.

The real benefits of groups are to create mailing lists and collaboration. I'll be dealing these after we’ve added some users and created admins.