AdvancedLesson 5 of 515 min
Policy with organizational units and groups
Google's answer to Group Policy. Units set the baseline, groups make the exceptions.
Admin settings in Google Workspace are applied in two layers. Organizational units carry the baseline. Groups carry the exceptions.
Organizational units
- Every user is in exactly one organizational unit.
- A child unit inherits its parent's settings unless you override them.
- Keep the tree small. Do not copy the org chart. Create a unit only when a set of people needs different settings.
- A shared drive sits in an organizational unit too. The drive's unit decides its sharing policy, not the units of its members.
Two kinds of policy group
| Topic | Access group | Configuration group |
|---|---|---|
| Purpose | Turn a service on for some people | Give some people a different setting |
| Can turn a service off | No. On only. | Can set any value |
| Against the organizational unit | Wins | Wins, for services that support it |
| Several groups disagree | Not applicable | The highest priority group wins |
Apply a setting to a group
- Step 1. In the Admin console, open the service and click the setting you want to change.
- Step 2. On the left, click Groups.
- Step 3. Search for the group by its address and select it.
- Step 4. Choose the value and click Save.
- Step 5. Drag the group up or down to set its priority. New groups start at the bottom.
- Step 6. To check the result, click Users on the left and pick a person. The console shows which setting applies and where it comes from.
Try it. Set values on the units and groups below and see which one wins.
Try it
Which setting wins?
Alex is in the Sales unit, under Staff, under the top-level organization. Alex is also in two policy groups.
Setting
Organizational units
Groups, highest priority first
- 1
- 2
For Alex: Allowed
Decided by: Configuration group. cfg-drive-external-allow is the highest priority group with a value. A group beats the organizational unit.
Why a group policy does not apply
- The group was created at groups.google.com instead of the Admin console.
- It is a dynamic group without the security label.
- Another group has higher priority.
- The setting does not support groups, so only the organizational unit counts.
- The change has not spread yet. Allow up to 24 hours.
Drive settings you will use most
- Sharing outside your organization. Off, on, or allowlisted domains only.
- Shared drive creation. Who is allowed to create shared drives.
- Allow users outside your organization to access files in shared drives.
- Allow people who aren't shared drive members to be added to files.
- Allow content managers to share folders.
- Allow viewers and commenters to download, print and copy files.
These are in the Admin console under Apps, Google Workspace, Drive and Docs. Defaults apply to new shared drives. Change an existing drive under Manage shared drives.
Controls that need higher editions
| Control | What it does | Available on |
|---|---|---|
| Target audiences | Suggests the right group in the Share window | Business Standard for Drive, Business Plus and up |
| Trust rules | Defines who may share with whom | Enterprise. Not Business. |
| Full data loss prevention | Blocks sharing of sensitive content | Enterprise. Business Plus has presets only. |
| Dynamic groups | Membership set by a rule, such as department | Enterprise |
| Context-aware access | Access by device, location or network | Enterprise |
Finished this lesson?
Facts checked November 12, 2026