GCP Workspace Admin key terms

A node in the Workspace hierarchy used to group users, devices, or other objects so that settings and policies can be applied differently to each group. Child OUs inherit parent settings unless overridden.

The rule that a setting configured on a parent organizational unit flows down to child OUs and their members, while a setting applied lower in the tree takes precedence for those members.

The web interface where administrators create and manage users, groups, devices, and service settings for the organization's Google Workspace environment.

The highest-privilege administrator role, able to manage all services, roles, and billing. Organizations should limit the number of super admins and protect these accounts with strong authentication.

A custom or predefined admin role that grants a user limited administrative privileges over specific services or OUs without giving full super admin rights.

Named collections of privileges that determine what an administrator can view or change in the Admin Console. Roles can be predefined or custom and are assigned per user.

A tool that provisions users, groups, and other directory objects from an external identity source such as Microsoft Active Directory into Google Workspace, keeping the two directories aligned.

A utility that synchronizes users, groups, and shared contacts from an on-premises directory to Google Workspace on a scheduled basis, typically used alongside single sign-on.

The process of creating, updating, and removing user accounts and groups, whether manually in the Admin Console, via API, or through a synchronization tool.

Collections of users used for mailing lists, access control, and sharing. Groups have their own addresses, membership, and roles such as owner, manager, and member.

A group whose membership is computed automatically from user profile attributes rather than maintained manually, reducing administrative effort and keeping access current.

An account that is blocked from signing in but retains its data and mailbox. Suspension is often used for temporary holds or departures instead of immediate deletion.

Permanent removal of a user account. Associated data may be transferred or retained depending on configuration, and the username may become reusable after a cooldown period.

The process of extracting an organization's Workspace data, such as mail, drive files, and calendars, for backup, migration, or legal purposes using export tools or APIs.

A service that lets users download a copy of their own Google data, including Workspace content, in standard formats for personal backup or migration.

Rules that define how long an organization keeps user data such as email and drive content before it is automatically purged, often set to meet legal or business requirements.

A configured policy in Google Vault that specifies which services and content are preserved and for how long, overriding default deletion behavior for covered data.

Google's eDiscovery and information governance tool used to search, hold, and export data for legal matters and to enforce retention policies across Workspace services.

A Vault feature that preserves a user's data indefinitely, preventing deletion or purging while an investigation or litigation is pending.

The process of identifying, collecting, and producing electronically stored information for legal or compliance purposes, typically performed in Vault.

A set of rules that detect sensitive content such as credit card numbers or personal identifiers in Workspace services and can warn, block, or quarantine sharing.

A Gmail setting that scans messages for specified content or attachment types and takes actions such as rejecting, quarantining, or modifying the message before delivery.

A holding area where messages or files flagged by a policy are kept for administrator review before being delivered, released, or discarded.

An access control feature that grants or denies access to Workspace and Google Cloud resources based on attributes such as user identity, device state, IP address, and location.

Reusable sets of conditions, such as device encryption or IP range, used by Context-Aware Access to decide whether a request from a user or device is allowed.

A security model that assumes no implicit trust based on network location and instead verifies every request using identity, device, and context signals.

An authentication requirement where users provide a second factor, such as a code or security key, in addition to their password. Admins can enforce it by OU or group.

Hardware tokens that provide phishing-resistant second-factor authentication. They can be required for administrators and high-risk users to strengthen account protection.

A configuration where users authenticate once with an external identity provider and are then granted access to Workspace services without separate passwords.

An XML-based standard used to exchange authentication and authorization data between an identity provider and a service provider, commonly used to configure SSO for Workspace.

Permissions that an application requests to access specific user data. Admins can restrict which scopes third-party apps may use to reduce data exposure.

Admin settings that decide which third-party and internal applications may access Workspace data through APIs, including trust and scope restrictions.

A configuration that limits which third-party applications users can install or authorize, blocking unapproved apps to reduce risk of data exposure.

Controls that determine whether users can share Drive files externally, with whom, and under what default access level, applied by OU or group.

Settings that direct inbound and outbound mail to specific destinations, such as gateways or alternate mail servers, based on sender, recipient, or content criteria.

A service that allows devices and applications to send email through Google Workspace using authenticated SMTP, often configured with IP allowlists.

Admin capabilities to enroll, configure, and report on Chrome browsers and ChromeOS devices, including policies, extensions, and version compliance.

Controls that govern how mobile devices access Workspace data, including password requirements, encryption, and the ability to wipe corporate data.

A tool that collects information about computers accessing Workspace data, helping admins assess device health and enforce access policies.

Records of administrative and user activity across Workspace services, used to investigate incidents, troubleshoot issues, and demonstrate compliance.

A dashboard that surfaces security and abuse alerts, such as suspicious sign-ins or malware, so administrators can investigate and respond quickly.

A console for running targeted searches across Workspace logs, such as Gmail and Drive events, to investigate threats and take containment actions like deleting messages.

A troubleshooting tool in the Admin Console that shows the delivery path and status of a specific email, helping diagnose why a message was delayed, blocked, or rejected.