The Complete G Suite Admin Guide
Why G Suite?
Google’s G Suite is quickly gaining market share with SMBs and enterprises alike, as a major challenger to Microsoft Office 365 with approximately 4 million paid users. With email as its centerpiece, G Suite features a group of productivity apps for business, ranging from document collaboration, to calendars, to video conferencing.
Many consumers and millennial workers are used to interfacing with Gmail and Google Docs, making the choice to adopt G Suite relatively simple for startups and SMBs. Recently, Google has doubled down on enterprise user acquisition, working closely with large companies to determine the features and functionality needed to close the gap with Microsoft.
Once admins configure G Suite correctly for businesses of any size, it is a great option for organization-wide (and inter-organizational) collaboration. We’ll show you how to use the G Suite admin console to ensure that your data and users are secure and productive.
Intro to G Suite Admin Console
The first step to setting up G Suite is deciding who should be privileged users — or admins — as well as what type of administrative privileges to assign to each person. A general best-practice for privileged access management is to only grant the minimum permissions needed for administrators.
Types of G Suite Admin Roles
Google has a great overview of the different pre-built administrator roles, but here are three key roles to consider:
Super Admin: These users have access to all features in the Admin console and Admin API, and can manage every aspect of the organization’s account. Super admins also have full access to all users’ calendars and event details. Google recommends that at least two people should have super admin access, just in case one user forgets his or her password (the other user can reset it). More than three super admins limits the options for password recovery, so two is a good general rule. For SMBs, super admins could be a founder and co-founder, or for medium-to-large businesses, this duty may be assigned to an operations or IT role.
Groups Admin: Google Groups make it easier for project teams to communicate and collaborate with one another. For example, you can send an email to everyone in a group with one address, invite a group to an event, or share documents with a group. Groups admins can add or delete Google Groups in the Admin console, managing the members and access settings within groups. It can be useful to have additional groups admins on top of the super admin to make team-level changes.
User Management Admin: These admins can perform all actions on users who aren’t administrators, including creating or deleting users, or managing users’ passwords and security settings. These tasks apply only to users who aren’t administrators themselves. User management admins might be the people in the organization responsible for employee onboarding and offboarding, such as an HR team member.
Once you have decided how to set up your admin structure, now it’s time to navigate the G Suite Directory.
G Suite Directory
The G Suite Directory includes each user’s name and email address (you can also add information like phone numbers, a physical address, and employee information.) From the Directory, you can get a comprehensive view of users, groups, organizational units, and buildings and resources. Let’s dive into what each sub-category means, as well as some best practices for G Suite admins.
Users: From the user directory, you can manage entire employee lifecycle, onboarding and offboarding employees when they start and leave the organization. Besides adding and removing users within your company, you can add external contacts who don’t have accounts in your organization, such as consultants or partners.
As much as possible, we recommend automating and streamlining onboarding and offboarding processes when it comes to IT, to ensure security and compliance at your organization. This can be a tedious process, so we built an easy and automated way to onboard new employees through Blissfully, giving them access to all the SaaS tools and apps they need (including G Suite).
Groups: Once you have your users added to G Suite, you can set up groups to create distribution lists for teams. Groups can help admins manage access to documents, sites, videos, and calendars. In addition, groups can make it easier to manage access and admin privileges.
A best practice is to sync Team Drives to Groups for easier document access management and employee onboarding and offboarding. With Team Drives, files belong to a team rather than an individual. For example, if you create a new Team Drive folder for a specific Group, and if an employee leaves the organization, offboarding that employee becomes as simple as revoking access to the group (there’s no need to transfer document ownership or reset permissions). To share a Team Drive with everyone in a group, simply invite that Group name to the Team Drive settings.
Organizational Units: Larger organizations may choose to implement organizational units to apply different layers of settings to certain users and devices. Initially in your Google Admin console, all your users and devices are placed in a single organizational unit. You can create sub-organizational units beneath your top-level organization, and then move users or devices into that sub-organization. Every user in the sub-organizational unit inherits the settings of their unit as a whole. For example, a super admin may choose to turn off certain applications or features for a sub-organizational unit. You can mix and match domains within an organizational unit, if you frequently work with people who do not share your same domain name, such as consultants or partners.
Buildings and Resources: If your organization has more than one office, or certain resource requirements such as conference room bookings or Jamboards (interactive conference room boards), you can use the buildings and resources section of the console to set these up. For example, through the buildings and resources directory, admins can configure the ability to select an available conference room along with a calendar meeting invitation, or connect a Jamboard to a conference room for interactive meetings.
G Suite Apps
G Suite features a range of built-in apps that are included in the platform. Not all of these apps are best-in-class, but many of them are extremely useful when you’re getting your organization’s IT services up and running.
Core Apps
Most people are familiar with the core, “killer apps” of G Suite, including:
Gmail: If you personally use Gmail, there’s a lot of continuity with the G Suite version. Admins can keep and search logs of emails as an added benefit for security and compliance.
Calendar: G Suite admins can specify how users can share their primary calendar inside and outside the company’s domain. For example, you can specify whether to show event details or keep them private, whether people outside your domain can change calendars, and more.
Google Drive / Team Drives (for G Suite Business and Enterprise): As mentioned above, Team Drives provide a simple way to store and organize files. The benefit is granting ownership of files to teams, rather than individuals. It’s easy to add and remove team members, or decide how you want to grant and restrict access.
You can choose from a range of permissions settings that control who can view, comment on, edit, create, and remove files, as well as who can add and remove people from Team Drives and individual files and folders. You can also set permissions that will prevent users from moving, deleting, or restoring files from the trash, so that you don’t have to worry about a disgruntled employee wrecking order for the rest of your organization.
Docs, Sheets and Slides: These core productivity apps in G Suite allow you to create documents, spreadsheets, and slide presentations, and easily share or revoke access for collaboration purposes.
Less Critical Apps
Certain Google apps can be useful for many applications, but aren’t necessarily best-in-class solutions for every use case. Here are a few examples:
Google Forms: This application can be good for organizations that need to manage a lot of events or conduct polls. Otherwise, it isn’t a daily must-have for most people.
Google Meet: This recently updated video conferencing app (formerly known as Hangouts) can also be used as a conference calling line. A wealth of other free conferencing apps challenge Google Meet in terms of reliability and audio quality.
Google Hangouts Chat: A quick and easy default chat app is ok for one-to-one interactions, but other applications like Slack may be better for group chat or collaboration.
Long-Tail Apps
These apps are new or recently updated, but not 100 percent necessary within most organizations. In the long-run, they may become increasingly useful, especially if Google continues to invest in product development.
Sites: Google Sites has been rebuilt by Google in the past few years, and can sometimes be useful to create company intranets. For Sites, G Suite admins can turn access rights for certain users on and off (or allow access to certain areas of a site).
Jamboard: Connecting Jamboard to Google Meet can be incredibly useful if you have a lot of remote employees, but the dedicated Jamboard hardware is expensive, and there are cheaper (or free) alternatives for collaboration.
Keep: Some people view Keep as a good way to keep notes and lists. Recently Google has added Keep reminders natively to Calendar, which can be a useful way to remember to complete a timed task.
G Suite Marketplace & Third Party Apps
In addition to built-in apps, admins can extend the functionality of G Suite with deep integrations to other third-party SaaS applications via the G Suite Marketplace. This marketplace includes both free and paid business applications, ranging from simple Gmail extensions to robust business productivity applications.
Many SaaS apps outside of the G Suite Marketplace also offer Single Sign On (SSO) with Google functionality. This feature is useful for admins who want to know which permissions people are giving to which apps. Admins can pull custom reports (which is relatively complicated), or automatically get this data from Blissfully. But, a little more on that later in our security section.
G Suite Security
When it comes to SaaS security, people can be either your best line of defense or your weakest link. It’s key to build your security policies and procedures around people, including taking the time to understand what is intuitive and user-friendly (and most likely to be followed). Generally speaking, we believe that you should rely more on systems and guardrails than on user actions and training. In other words, take human error out of the equation whenever possible.
The good news is, with G Suite, there are quite a few security tools and configuration options at your disposal. However, these are no good to you unless they are thoughtfully implemented and automatically enforced. Here are the areas you should be looking at securing when it comes to your G Suite applications.
Multi-Factor Authentication
The single best thing you can do to improve your organization’s cloud security is to turn on and enforce multi-factor authentication (MFA) for G Suite. This greatly reduces the harm that an attacker can do with stolen credentials.
While this may seem like a requirement in today’s age, our data shows that the average company only has 37% of their employees using MFA on their main G Suite account. And this number gets even worse for smaller and early-stage companies, where just 22% of employees at companies with less than 50 people have multi-factor authentication enabled.
Another benefit of implementing strong Google-based authentication is that many SaaS products are increasingly supporting Google SSO, which means that if you enforce MFA for Google, you’ll automatically get those benefits for all apps that use Google SSO.
Team Drives
As we’ve discussed, G Suite Team Drives are shared spaces for teams to store and access their files. This feature is included in the Business and Enterprise versions of G Suite. Files in Team Drives belong to the entire team rather than to individuals. This makes life easier if someone leaves your team, because there is no need to transfer document ownership or reset permissions. The files stay put regardless of any individual’s status, so employees can get work done without interruption.
There is also a security benefit to using Team Drives. When you add new members, you can decide whether you want to give them full access to upload, edit, and delete files, or whether you want to restrict them to certain activities at the user level. It is easy to add members, set and change member permissions, and remove members as needed.
App & File Sharing Activity Reports
Another important function of the G Suite Admin Console is reporting. Two especially useful reports are “Apps Usage Activity” and “File Sharing Activity.” App usage can give you an indicator on how many total emails, files, and video hangouts have been shared within a set period of time. For example, if a user’s email is hacked, there may be an unusual volume of activity indicated for the Gmail app. File sharing activity can show you exactly how files have been shared both inside and outside the organization’s domain in a set timeframe. If there are an unusual number of shares outside the domain, you’ll be able to drill down and find out why this may be happening.
Device Management
G Suite has two ways for admins to manage devices, with its mobile device management and endpoint verification tools.
Mobile Device Management: Admins can distribute apps to employees and keep data secure on employee’s iOS and Android devices using mobile management. Using these tools, you can check usage, manage security settings, and lock or wipe devices remotely.
Endpoint Verification: Google recently rolled out Endpoint Verification, a way for G Suite admins to get an inventory of which desktop and laptop computers are being used to access their corporate data and apps. Endpoint Verification collects information via Chrome extensions and native apps on users’ devices, and displays that information to admins in a report in the Admin console.
SaaS App Auditing
As we mentioned above, If your team use Google SSO, you can pull reports in your admin console to find out if your users have authorized any unknown or unapproved apps through their Google accounts. Or, you can use Blissfully as a much simpler way to review app permissions with a click of a button.
Final Thoughts
We hope this guide to G Suite Admin basics was useful to you, as you look to set up G Suite for your organization. Setting the right administrative privileges and following these best-practices can help keep your organization secure, compliant, and productive. It’s all a matter of having the right visibility into user activity, while setting and automating as many processes as possible to avoid unnecessary human error. If you’re looking to automate even more processes and gain a new level of visibility into SaaS app usage across your organization, try Blissfully out today!
Originally published at www.blissfully.com.
