As an Administrator, you can control who can use which core Google services by turning the service on or off for users in your Google Admin console. When users sign in to their account, they’ll only see the services that are turned on for them.
To manage service access for users, you can use organizational units (OUs) for department-wide access and access groups for access across or within departments.
You also can choose which additional Google services, like YouTube and Blogger, are available to your users. Some services have a simple on/off switch in the Admin console, while others don’t. Services without the on/off switch cannot be turned on or off individually, but the list of services without this option can all be turned on or off at once.
In this exercise, you’ll practice turning services on and off for an entire organization, for an organizational unit, and for a specific group.
Confidentiality of corporate information is important to your company. As the Administrator, the IT manager has asked you to restrict access to certain Google services for everyone.
Turn Sites and Blogger off for everyone
Step 1
Sign in to your domain as the Administrator at admin.google.com.
Step 2
From the main menu, navigate to Apps, then select Google Workspace, and then click Service status.
Step 3
Core services like Sites are generally enabled for everyone by default. To turn off this service, locate Sites in the list and click the ellipsis icon (three vertical dots) at the end of the row. Then click Turn OFF for everyone.
Step 4
Click TURN OFF to confirm.
Step 5
To verify the service is now disabled, open a new browser tab and go to sites.google.com. You should see a message that you do not have access to that service. You may need to wait a few minutes for the changes to take effect.
Step 6
You must now turn off Blogger as per Alex's request. From the main menu, navigate to Apps, then select Additional Google services.
Step 7
Locate Blogger in the list and click the ellipsis icon (three vertical dots) at the end of the row. Then click Turn OFF for everyone.
Step 8
Click TURN OFF to confirm.
You've successfully turned off the two services for your whole organization.
After turning off Sites and Blogger for your company, you receive another email from Alex the next day.
Enable Sites for Executive OU
Step 1
If you are not already signed in, sign in to your domain as the Administrator at admin.google.com.
Step 2
From the main menu, navigate to Apps, then select Google Workspace, and then click Service status.
Step 3
Locate and select the Executive OU. You are now viewing the status for Apps in the Executive OU only. Please note that Sites is currently turned off as it inherits its setting from the top-level organization.
Step 4
To turn Sites on for this OU only, locate Sites in the list and click the ellipsis icon (three vertical dots) at the end of the row. Then click ON (Override).
Step 5
Click TURN ON to confirm. The Sites service status should change to ON.
Step 6
Select another OU and/or the top level organization, and verify that the Sites service remains OFF for other parts of the organization.
Step 7
Click on the Executive OU.
Step 8
Locate Google Chat in the list and click the ellipsis icon (three vertical dots) at the end of the row. Then click OFF (Override).
Step 9
Click TURN OFF to confirm. You may need to confirm a second time. If prompted, click TURN GOOGLE CHAT OFF.
Well done! You've successfully changed access to some Google services for a specific OU. These changes will override the settings you have in place for the whole company.
The requests keep on coming! A few days after enabling Sites for executives, you receive the following email from Alex.
Enable Sites for Raha
Step 1
From the main menu, navigate to Directory, and then select Groups.
Step 2
Click Create group, and enter the following information:
Group name: Access Sites
Group email: access.sites@yourdomain
Group description: Users with access to the Sites service regardless of their OU setting
Step 3
Click NEXT.
Step 4
Set the Access type by ensuring only Group members (and owners/managers) have permission to post and view topics. Uncheck External and Entire Organization to keep it restricted.
Step 5
Click CREATE GROUP.
Step 6
Click the Add members to Access Sites link, and add Raha G as a member.
Step 7
Now we'll enable Sites access for the group created above. From the main menu, navigate to Apps, then select Google Workspace, and click Sites.
Step 8
Click Service status. On the left-hand side of the screen under the Groups section, use the Search for a group field to find and select Access Sites.
Step 9
In the center panel, change the Service status to ON.
Step 10
Click SAVE (or OVERRIDE) at the bottom of the screen to confirm the group-level setting.
Step 11
(Optional) To verify that Raha can now access the Sites service, sign out as the domain Administrator and sign back in as Raha. Then go to sites.google.com. Even though Raha's OU has Sites disabled, the Sites page should load because her membership in the access group overrides the OU restriction.
It can take up to 24 hours for a service activation or deactivation to take effect.
Some services depend on other services. Dependent services cannot be enabled unless the services they depend on are also enabled.
Groups turn on user access to Google Workspace core services, and Google, additional services. Groups can’t turn off user access to a service that’s turned on for an organization.
It's a good practice to develop a naming convention for access groups such as the one created in this exercise, e.g., prefix the group name or email with Access or AX.
An access group can contain users from any organizational unit or another group (nested groups).
For more guidance on managing services, please explore the Google Workspace Admin Help Center: