1

I work at a fairly large company (65k+ users) which has massively adopted Google G Suite and I work with the G Suite admin team to architect our environment. One of the things I'm struggling with is how Google manages the organizational structure in its identity tools.

From what I understand, Google features are enabled/disabled purely on an OU-basis, and a user cannot belong to more than one OU. So if we need to selectively manage some features for certain subsets of users, we end up having to essentially duplicate our entire OU structure to account for people who should have this new feature, and those that shouldn't.

This has made our OU structure prohibitively large, and we're actually contemplating creating an entirely separate account structure (or even structures plural) in a new domain to manage backend services (typically from GCP) that only a few users should have access to (e.g., Adwords) because there doesn't seem to be any reasonable way to do this in our existing hierarchy.

Is there an official Google solution to support managing feature activation on a large user base where each feature may have distinct user populations?

  • This looks to me a too broad and primarily opinion-based question. Could you edit it to make it specific as it's required on How to Ask. Also mention if you are a G Suite administrator or a regular user and if you already learned about Google Cloud Connect. – Rubén Jul 25 '18 at 15:49
  • @Rubén I have edited the question to (hopefully) clarify the precise issue I'm trying to solve. – Jeremy Gibbons Jul 25 '18 at 20:25
0

From what I understand, Google features are enabled/disabled purely on an OU-basis, and a user cannot belong to more than one OU. So if we need to selectively manage some features for certain subsets of users, we end up having to essentially duplicate our entire OU structure to account for people who should have this new feature, and those that shouldn't.

You are right.

Note: Some services like AdWords now have ways to collaborate with others, but this allows collaboration on certain assets not allow/disallow access to a Google service.

Is there an official Google solution to support managing feature activation on a large user base where each feature may have distinct user populations?

AFAIK there isn't an out-of-the-box solution, but the Directory API includes features to manage organizational units -> Directory API: Organizational Units

References

  • Thanks for the ideas. I do know we can manage the OUs programmatically that way, and we could conceivably brute-force the issue that way, but there is still exponential complexity growth underneath since we would be doubling the tree size every time a product is added: it would probably get out of hand before long, and still be a nightmare in terms of compliance. – Jeremy Gibbons Jul 26 '18 at 6:16
  • Have you already look for the solution that you are looking for on the G Suite Marketplace, the Google Partners Directory and/or to Google Cloud Connect? – Rubén Jul 26 '18 at 15:11
  • How about just assign department and divisional managers the roles of service admins? – daniel Jul 26 '18 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.