Managing Core Workspace Services
Core concepts
Core services are Gmail, Calendar, Drive and Docs, Meet, Chat, and Groups, each with service status (on, off, or allowed for specific OUs/groups) and per-service settings. Gmail settings include routing, compliance rules, spam and attachment policies, and gateway configuration. Drive settings cover sharing defaults, link-sharing, offline access, and Drive for desktop. Calendar covers external sharing and resource booking. Meet covers recording, streaming, and who can join. Service status is inherited down the OU tree, and turning a service off for an OU overrides a parent's on setting.
Traps
Candidates confuse service status with feature settings: disabling a feature does not disable the service. Sharing settings in Drive have both an org-wide default and an override at the OU level, and link-sharing defaults interact with trust rules. Gmail routing and compliance rules can conflict, and rule order matters. Enabling a service for a child OU does not automatically enable it for that OU's subgroups unless targeting includes them. Another trap: some settings apply only to newly created items, not retroactively.
Rule of thumb
Set the most permissive baseline at the root and restrict at child OUs. For a worked example, to allow external sharing only for the Sales OU: leave the root Drive sharing default restrictive, create a Sales OU, and set its sharing override to permit external sharing while keeping link-sharing limited to the domain. Verify by testing with a member of that OU.
Worked check
When a service appears off for a user, walk up the OU tree and check group-based overrides before assuming a bug.