A Google Workspace organizational unit (OU) is a container in the Admin console that groups users so you can apply different settings, apps, and security policies to each group. A user belongs to one OU at a time, and child OUs inherit their parent's settings unless you override them. The top of the tree is your whole organization, and everything you set there applies everywhere until a lower OU changes it.
Most small businesses meet organizational units without realizing it. Every Google Workspace account starts with one OU, the organization itself, and many companies never add a second. That is fine until two teams need to be treated differently, at which point the OU is the tool that makes it possible without buying anything or moving anyone's email.
What is a Google Workspace organizational unit?
An organizational unit is how Google Workspace lets you say "these people get these rules." It lives in the Admin console under Directory, then Organizational units, and it is the place where you control which apps and services are turned on, what security settings apply, and what Chrome or device policies a person receives. Settings attach to the OU, and every user inside that OU inherits them.
The point that trips people up is the difference between an organizational unit and a group. They sound similar and do opposite jobs:
| Organizational unit | Group |
|---|---|
| Controls settings and policy: apps on or off, security rules, device and Chrome policy. | Controls email distribution, sharing, and access to specific resources. |
| A user is in exactly one OU at a time. | A user can be in many groups at once. |
| Answers "what is this person allowed to use and how is it secured?" | Answers "who should receive this email or reach this folder?" |
Used together, OUs shape the environment a person works in, and groups handle the overlapping access that real teams need.
Why do organizational units matter for a small business?
For a company of 25 to 100 people, organizational units are the difference between one blunt rulebook for everyone and settings that match how the business actually runs. A few examples that come up constantly:
- Tighter security for the people who handle money or patient records, without forcing the whole company through the same friction.
- A different set of apps for a clinical or field team than for the back office, so each group sees only what it uses.
- Chrome and device policies for shared or front-desk machines that should behave differently from a manager's laptop.
- Cleaner onboarding, because dropping a new hire into the right OU hands them the correct settings the moment the account is created.
None of this requires extra licenses. It is configuration, which is exactly why a thoughtful structure pays off quietly for years and a careless one creates confusion every time someone joins or changes roles. A Google Workspace Security Assessment often surfaces OU structure as one of the first things worth tightening.
How should you structure organizational units?
There are two common shapes, and the right one depends on what actually differs between your teams.
By department
Finance, operations, clinical, sales. This fits when the meaningful differences are about job function: who needs stricter security, who needs which apps. It is the most common structure for a single-office business.
By location
One OU per office or site. This fits when policy is driven by place, for example different printers, networks, or device rules per location, or a franchise model where each site is run semi-independently.
Whichever you pick, three rules keep it sane. Plan the tree on paper before building it, because moving users later is easy but re-thinking a tangled structure is not. Keep it as shallow as the business allows, since every layer is something to maintain. And use descriptive names, so "Clinical Staff" explains itself a year from now and "OU2" does not. NeuGenity builds this during a Google Workspace configuration so the structure is right before anyone relies on it.
How do you create an organizational unit in Google Workspace?
Creating an OU takes a couple of minutes in the Admin console. The work that matters is deciding what goes in it, not the clicks themselves.
- Open the Admin console. Sign in at admin.google.com with an administrator account.
- Go to Organizational units. Open Directory, then Organizational units, to see your current structure.
- Create the OU. Point to your top-level organization, click Create organizational unit, enter a descriptive name, confirm the parent, and click Create.
- Move users in. Open Directory, then Users, select the people, choose Change organizational unit, pick the new OU, and confirm.
- Apply settings. Open the relevant area such as Apps or Security, select the OU in the left panel, and set the policy. It applies to everyone in that OU and inherits to any OUs beneath it.
What are common organizational unit mistakes?
The pattern behind most OU problems is the same: structure built in a hurry, then inherited by whoever manages Workspace next. The usual ones are over-building (a deep tree no one remembers the logic for), under-building (one OU for a company that clearly needs differentiated security), vague names, and applying a policy at the organization level when it was only meant for one team. Each is easy to avoid up front and tedious to untangle later, which is the whole argument for planning the structure deliberately. Businesses that want a specialist to own this long term move to the Google Companion membership so the structure stays clean as the team grows.