GCP Workspace Admin cheat sheet

Directory API user insert requires primaryEmail plus name.givenName and name.familyName; password is optional but omitting it forces a change at first login.

Suspending a user (suspended=true) blocks sign-in but retains data, licenses, and the mailbox; deleting a user removes the account and the username can be reused after deletion.

Organizational units are a single-parent tree; a user belongs to exactly one OU, and child OUs inherit settings from parents unless overridden.

Groups have direct members and nested members; group-based settings apply to members, and nested membership counts for most policy evaluation but not for every license assignment.

Aliases and nicknames route mail to the primary address; a nickname is domain-scoped and must be unique within that domain, while aliases can also be external addresses.

Bulk operations use the Directory API or CSV upload; the Admin console CSV import supports user creation, updates, and OU moves in one file.

Admin roles are either predefined or custom; a custom role is built from granular privileges, and role assignments can be scoped to a single OU.

Super Admin is the only role that cannot be deleted or fully restricted; best practice is at least two Super Admins with 2-Step Verification enforced.

Gmail routing rules evaluate in priority order; the first matching rule applies, and rules can also be configured as address lists or recipient map entries.

Gmail compliance settings differ from routing: content compliance inspects message body/attachments, while objectionable content and blocked senders use separate rule types.

Calendar sharing defaults are set per OU; the maximum external sharing level (e.g., 'Share all information') caps what individual users can grant.

Drive sharing settings define the OU default and the maximum; external sharing can be limited to allowlisted domains via the Domain allowlist.

Drive file ownership transfers require the new owner to have an active license and available storage; transfer of files owned by a suspended user is allowed.

Google Groups access settings control who can view membership, post, and join; 'Who can join' and 'Who can view members' are independent controls.

Meet and Chat settings inherit from the OU tree; turning off a service at the parent OU disables it for children unless explicitly overridden at the child.

Service status per OU is On / Off / Overridden; 'Overridden' means the child OU differs from the parent's inherited value.

Google Vault retention rules are per-service (Gmail, Drive, Groups, Meet, Chat); a default rule applies to all users, and custom rules can target specific OUs or groups.

Vault retention holds data beyond the user's deletion; a hold prevents purge even after the retention period expires, and holds can be scoped by OU, group, or specific accounts.

Vault export produces a matter-scoped export to Google Cloud Storage or a download link; exports are limited to the data types selected in the matter.

Data regions (formerly data localization) let you choose where covered data at rest is stored for select services; coverage is service-specific and not all Workspace data is included.

Google Takeout for Workspace is controlled by an admin setting; when enabled, users can export their own data, which can conflict with retention/hold policies.

Drive DLP rules scan content for predefined or custom detectors; a rule can warn, block, or audit, and applies to files shared internally or externally per its scope.

Audit logs (Admin, Drive, Login, etc.) are retained for 6 months by default and are exportable to BigQuery or Cloud Storage for longer retention.

Client-side encryption (CSE) keeps content encrypted before it reaches Google; key access is managed by the customer's external key service, not by Google.

2-Step Verification enforcement is set per OU; once enforced, users must enroll at next sign-in, and enforcement cascades to child OUs.

Context-Aware Access uses access levels built from device, IP, and user attributes; an access level is attached to apps in the Admin console to gate sign-in.

Password policy settings (length, reuse, expiration, strength) apply per OU; a minimum length of 8 is the common baseline and stronger policies can require 12+.

OAuth app allowlisting (API controls) blocks unconfigured third-party apps; trusted apps are added to the allowlist, and 'unconfigured apps' can be set to blocked.

Less secure app access (LSAs) is deprecated; legacy protocols (IMAP, POP, SMTP AUTH) are instead controlled by per-OU toggles for each protocol.

Security keys and passkeys are phishing-resistant; the Admin console can require security keys for specific OUs, with a grace period before enforcement.

Super Admin roles should be limited; use the Security center / alert center to monitor risky sign-ins, and restrict admin console access by IP allowlist where possible.

Login challenges and suspicious login detection trigger additional verification; admins can review and remediate flagged sign-ins from the security dashboard.

Chrome Browser management requires enrollment via a Cloud Management token or a policy; enrolled browsers report to the Admin console under Devices > Chrome.

Chrome policies (e.g., force-install extensions, block extensions, safe browsing) are set per OU and pushed to enrolled browsers.

Android and iOS device management controls require mobile device management (MDM); Workspace supports basic and advanced mobile management tiers.

Advanced mobile management enables device approval, work-profile separation on Android, and remote wipe of corporate data on BYOD devices.

Endpoint verification (the extension) reports device inventory (OS, serial, encryption) to the Admin console and is required for some Context-Aware Access levels.

Remote wipe on a BYOD device removes only Workspace-managed data; a full device wipe is available only for company-owned devices.

Windows/macOS device management uses the Google endpoint management agent for inventory and device trust signals; it is separate from Chrome browser enrollment.

Device approval blocks unapproved devices from accessing Workspace data; admins approve devices manually or via policy.

If a user cannot sign in, check in order: account status (suspended/archived), password/2SV, OU service status, then login challenge or access level.

Mail delivery failures: inspect Gmail routing rules and content compliance first, then check the recipient's spam/quarantine and the Email Log Search tool.

Shared Drive access issues: verify membership role (Manager/Contributor), the sharing setting at the Shared Drive level, and whether the OU blocks external sharing.

Calendar invites not appearing: check the user's Calendar sharing settings, the 'external invitations' policy, and whether the event was blocked by a routing rule.

Group email not received: confirm the sender is allowed by the group's posting permissions and that the member is a direct or nested member.

Sync errors (Google Workspace Sync / GCDS): check the sync service account credentials, the LDAP connection, and the last sync log for failed objects.

Storage full errors: check per-user Drive storage, Shared Drive quotas, and whether the OU has a storage limit policy applied.

Audit log investigation: use the Admin audit log for admin actions, Login audit for sign-in events, and Drive audit for file access; filter by user and time range.