Google Workspace for Education: Domain best

practices
This guide provides an overview on the different ways to set up a domain for your Google
Workspace for Education account and focuses on:

1. Setup recommendations
A brief overview of how we recommend that you set up a domain with your Google Workspace for
Education account.

2. Domain setup options

There are 3 ways you can set up your domain, and the one you select depends on your
environment.

3. Organizational unit structure

Organizational units help you control which applications, services, settings, and device policies are
available to users. With good design, you can simply and efficiently set up different services and
policies for different groups of users.

4. Provisioning users and groups

Highlights how to create users and groups, and how one of our partners can help.

5. Online resources
Links to online resources and tools to give you more information.

Note: Additional technical resources on deploying Google Workspace for Education and Chromebooks as
well as networking best practices can be found in our deployment guides for Google Workspace for
Education administrators.

If you’re also interested in piloting devices in your organization, details can be found in the Google for
Education Pilot Guide.

Use this guide to get started with Google Workspace for Education and learn best
practices.

2. Google Workspace for Education: Domain best practices

1. Setup recommendations

Review Google Workspace for Education Privacy Notice

We recommend you review the Google Workspace for Education Privacy Notice for information on
how Google collects and uses information from Google Workspace for Education accounts
specifically. You can also visit the Google for Education Trust site for answers to Frequently Asked
Questions (FAQ).

Work with a partner

Partners make life easier. They have experience and expertise and can significantly reduce the time
to deploy Google Workspace for Education. We strongly recommend working with one of our
partners.

Use a single Google Workspace for Education account

If possible, we recommend using a single Google Workspace for Education account with only
one domain. However, if you have separate domains, we recommend managing them in a single
Google Workspace for Education account so you can use one account in the Google Admin console.
We call this multiple domain management. We don’t recommend creating separate Google
Workspace for Education accounts for each domain as this limits sharing capabilities. It’s also a
manual, time-consuming, and unsupported process if you need to merge Google Workspace for
Education accounts in the future. There are some limitations to managing multiple domains for one
account, which you should keep in mind if you have multiple domains.

Organizational structure importance

You’ll control all of your domain’s services via organizational units. A simple way is by school (if
you’re a district) and by grade level. You should decide on a structure that is scalable and relevant
for you.

Share using Google Groups

It’s important that you create a logical organizational unit structure, but are also able to share
resources using Google Groups. For example, if you’re going to be sharing within classes, you can
create groups that contain class members. An administrator can be in charge of creating groups or
you can enable users to create groups as well through Google Groups for Business.

Synchronize your LDAP structure to Google Workspace for Education

If you have an LDAP server, it may be useful to map the existing organizational unit structure to
Google Workspace for Education using Google Workspace for Education Directory Sync (GADS). This
simplifies the management of both environments and gives you more time to focus on other things.

Integrate your information system with one of our partners

When provisioning Google Workspace for Education accounts, it can be time-consuming to export
users from a legacy environment and then import them to Google Workspace for Education. There
are partners who can collect all the information, put it in the cloud, and keep it up to date for your
users.

3. Google Workspace for Education: Domain best practices

4. Google Workspace for Education: Domain best practices
2. Domain setup options

There are 3 ways you can set up domains with Google Workspace for Education, and the one you
select depends on how you want to configure your users’ Google Workspace for Education
accounts with a domain.

Primary domain option

This option is used for a single Google

Workspace for Education account with one
domain name. You can use domain aliases to
give users the ability to send and receive mail
from different email addresses (also called
“nicknames”).

This is the simplest and easiest way to

administer your domain and is best suited for
Google Workspace for Education customers.

Example: Single school or university, such as

university.edu

Multiple domains option

This configuration still applies to a single Google

Workspace for Education account per user, but
the account is set up with multiple domains or
subdomains, allowing for different user names.

This is the most common design for institutions

that manage more than one domain and require
user names for each domain.

Example: School, university, or district with

multiple related domains, such as
law.university.edu, eng.university.edu, or
district.edu.

Separate Google Workspace for

Education accounts option

This option allows you to completely separate

domains into individual Google Workspace for
Education accounts, but requires multiple Admin
console accounts.

This setup is used by partners who manage separate

customers, but it’s not recommended for schools.

5. Google Workspace for Education: Domain best practices

 Example: Partner managing multiple customers,
such as customer1.edu, customer2.edu and
customer3.edu.

Google Workspace for Education domain design comparison

Following is an overview of the capabilities of each domain design option as well as the advantages and
disadvantages to help you decide what’s best for your environment. Make sure you also review limitations
for multiple domains and the FAQ on additional domains. For details on managing domains, see Managing
Multiple Domains with Google Workspace for Education.

Feature Primary Multiple Separate

domain domains accounts
Single unified administration management
experience (1 Admin console account and Yes Yes No
support PIN for all licences)

Collaboration functionality for Google Docs,

Sheets, Slides, and so on
Best OK Limited

Single Google Workspace for Education

directory (list of users) for all users and shared Yes Yes No
contacts

Single booking system for shared calendar

resources
Yes Yes No

Email delegation available between any users Yes Yes No

(with workaround)

Number of sync tools, such as GADS or Google

Workspace for Education Password Sync One One Multiple
(GAPS), required

Ability to create individual users, such as

[email protected] and [email protected], in any
domains added to your Google Workspace for
No Yes Yes
Education account

Ability to transfer a user between domains --- Easy Difficult

(Manual migration)

Primary domain Multiple domains Separate accounts

Advantages ● Easy management of ● Easy reporting per domain ● Easy reporting per domain
policies and configuration ● Easy to restrict delivery ● Easy to restrict delivery setting
settings setting per domain per domain
● Complete view and ● Completely independent
management of entire management per Admin
organization and all users console account

6. Google Workspace for Education: Domain best practices

 Disadvantages ● Reporting per ● See Limitations with ● Only partial view and
organization is not multiple domains management of entire
difficult (but possible) ● Chrome management organization
licenses applied to ● Different provision processes
organization as a whole (users, mail flow, data, and so
on) per Admin console account
● Complex sharing settings
● Contact sharing limitations
● Unable to use Android setup
across n-n
● Unable to use full Google Play
for Education functionality

Typical use case ● Recommended option ● Only if there’s a need to ● Only if the organizations in the
have different domains different Admin console
that can’t be solved with a accounts work completely
domain alias or restrict independently
delivery setting request

Note: You can’t restrict sharing to the users in a single domain. Sharing options are based on the
organization as a whole, not individual domains. This is why we recommend a single Google Workspace for
Education account for each student and faculty member.

Be aware that merging Google Workspace for Education accounts after you create separate ones is a
manual and time-consuming process. Contact one of our partners if you need third-party assistance.

Delegated administration

For complex structures, delegated administration might be necessary so that different administrators can
manage different sub-organizations. Depending on the structure, one or more super administrators
manage the complete organization. You can assign user management roles to delegated administrators.

7. Google Workspace for Education: Domain best practices

3. Organizational unit structure

You create organizational units and structure them to control which settings and device policies
are available to users. A well-designed structure is critical to effectively and flexibly manage your
Google Workspace for Education account. The one you decide to use depends on the size of your
deployment and organizational needs.

Large deployments
There are 2 options for structuring larger deployments, which usually spread farther than a single school
and include other organizations or schools across a district, state, or region:

● Role-oriented structure
● Organization-oriented structure

1. Role-oriented structure

In a role-oriented structure, first-level organizational units are organized by role, such as students
and teachers. This structure works well if you need to define policies and settings independently of a
district or school, and if simple maintenance is a priority.

2. Organization-oriented structure

An organization-oriented structure works well when organization and control is a priority. The

8. Google Workspace for Education: Domain best practices

 first-level organizational units are organized by region, district, or school, with policies and settings
defined by this structure. Although you have more control, you need a delegated administrator per
first-level organizational unit.

Small and medium deployments

Small and medium deployments include single schools and universities, or one Google Workspace for
Education account with multiple domains.

1. Single school or university

If your deployment involves a single school or university, you can simply create organizational units
for the major groups of users and categorize them by the specific services or settings they have
enabled. From there, you can create sub-organizational units, such as subject or grade. We also
recommend that you create a Google group for each sub-organizational unit so that you can share
Google Docs and other items via the group.

9. Google Workspace for Education: Domain best practices

 2. School, university, or district with multiple related
domains

If you need to manage multiple domains within a single Google

Workspace for Education account, you can create a separate
organizational unit for each school, such as School1.com and
School2.com. Utilizing sub-organizational units allows you to
further organize and manage the separate domains.

Which Google Workspace for Education services for users?

For the best user experience, we recommend enabling all Google
Workspace for Education services by default. In addition to the
core services, you also have access to other Google services, each
with their own Terms of Service.

Note: You can’t share an individual item, such as a Google Sheets

file, with an organizational unit, but you can use Google Groups to
organize users and share files.

10. Google Workspace for Education: Domain best practices

4. Provisioning users and groups

Creating users and groups is one of the first things you’ll do after setting up your domain.

There are multiple ways to create users and groups in Google Workspace for
Education:

● Manually add users and groups individually in the Admin console.

● Add multiple users at once by uploading a .csv file in the Admin console.
● Synchronize and create users and groups automatically from your LDAP
directory server in Google Workspace for Education (recommended if you use
an LDAP server).
● Provision users and groups with partners who can place your student
information system (SIS) in the cloud to create users in Google Workspace for
Education (recommended).
● Create your own provisioning application using the Google Workspace for Education Directory API.

Provisioning method Benefit Cost Notes

Easy to do and If you have a lot of

Manual provisioning quickest way to get set users, this manual Manual process and not
(Admin console) up if you don’t have process could take scalable
many users a long time

Easy to do and quick Requires you to

CSV upload
for creating many create a list Manual process
(Admin console)
users at once of users

Google Workspace for

Education Directory Sync GADS is recommended i
(GADS) Automated method to Requires time to you have an LDAP
or create and continually configure the tool, directory server as it not
Google Workspace for synchronize all your but it’s a one-off only provisions users, bu
Education School users and groups setup continually synchronizes
Directory Sync new ones

Integrates with your

Directory API Requires coding Applicable for highly
specific environment
(Custom development) experience complex environments
and useful for

11. Google Workspace for Education: Domain best practices

 complex directories

Legal Quickest and easiest wa

Provisioning partners
considerations for to get your Google
(Who use Directory API) Automated method
placing SIS in the Workspace for Educatio
cloud account up and running

Note: We recommend that you enter the Admin or Help desk contact information for end user password
recovery, so users can contact the right team in case of any login issues, it only takes 1minute! See this
article for the specific steps.

5. Online resources

Below is a list of the links used in each section of this document as well as additional resources.

Best practices for domain design, organizational structure, and Single Sign-On
● Limitations with multiple domains
● Google Workspace for Education Directory Sync
● Google Workspace for Education Password Sync
● Google Workspace for Education School Directory Sync
● Find a partner

Domain setup options

● What is a domain?
● Managing multiple domains
● Add domains and domain aliases

Provisioning users
● Options for adding users
● Upload many users at once
● Admin SDK
● Creating Groups
● Directory API (new)

Organizational unit structure

● Controlling which applications and services are available to users
● Configuring available services differently for different sets of users
● Configuring different Chrome device settings for different sets of devices
● Google Groups and Google Groups for Business
● Sharing with a group

Single Sign-On

12. Google Workspace for Education: Domain best practices

 ● SAML Single Sign-On (SSO) Service for Google Workspace for Education
● Setting up Single Sign-On for Google Workspace for Education
● Open ID: Using Google Workspace for Education as the Identity Provider (IdP)

Additional references
● Google Workspace for Education Technical Transition Guide
● Chrome Devices for Education Technical Planning Guide
● Going Google guide
● Google Workspace for Education Learning Center
● Administrator guide to accessibility
● Google for Education Trust Website
● Google Workspace for Education Privacy Notice

13. Google Workspace for Education: Domain best practices