Review: Managing user accounts, domains and directories

Section 1 of the exam guide, about 20 in every 100 questions, covers the foundations: getting people into the directory, organizing them, grouping them, the domains they use, and the rooms and resources they book. It is the section Owen knows best, because he built all of it in GCP-210. That is exactly why Sofia wants it reviewed first. "The things you know best are the things you stop checking," she says. "Let's see whether you know the options, not just the choices we made."

Each review lesson in this course follows the same pattern. It walks through the objectives in the guide, summarizes what to know in exam terms, names the decisions the exam likes to test, and lists the points Owen marked as unsure. It is not a replacement for the earlier course; it is a structured check against the guide.

1.1 The user life cycle

Every account goes through the same stages: it is created, placed, changed, paused and finally removed, with data handed over before removal. The exam asks which tool fits each stage, and especially which provisioning method fits an organization.

Single sign-on appears in this objective at a basic level. With SAML single sign-on, Workspace trusts another identity provider to authenticate users: the user goes to Google, is sent to the provider to sign in, and returns with a signed assertion. The exam expects candidates to know the pieces: the provider's sign-in page URL, its signing certificate, an SSO profile assigned to OUs or groups, and that super admins sign in with Google rather than through the third-party provider, so they can still get in if the provider fails. Birchline uses Google as its identity provider, but Owen reviews the opposite case because questions often describe it.

Migration tools are part of 1.1 too. The guide asks candidates to match migration strategies to tools. In exam terms: the data migration service in the Admin console moves mail, calendars and contacts from servers or other Google accounts for small and medium moves; Google Workspace Migrate is a larger, server-based tool for big migrations with many sources, including file shares; and a desktop or server tool for Microsoft Exchange and Outlook moves mail, calendar and contacts. Google renames these tools from time to time, so Owen checks the current names in the documentation before the exam rather than relying on GCP-210's list.

Changing, pausing and removing accounts

The exam often tests the order of offboarding: suspend or reset sign-in immediately, transfer data to a manager or a shared drive, confirm that Vault retention or holds cover anything legally required, then delete or archive. Deleting before transferring loses files the restore window may not recover in time. Owen also reviews password objectives: administrators can reset a password and require a change at next sign-in, enforce strength and length, and see password strength status per user, but they cannot see a user's password.

Licence management belongs here as well. Licences can be assigned automatically by OU, assigned in bulk, or managed per user. A user with no licence for a service cannot use it even if the service is on for their OU. That combination, service on but no licence, is a favourite exam explanation for "one user cannot use Meet".

1.2 Organizational units

An organizational unit is the main way to apply settings to a set of users or devices. Child OUs inherit settings from their parent unless the child overrides them. Each user belongs to exactly one OU. The guide asks candidates to design an OU structure that reflects the organization and follows Google's recommended practices. In exam terms, those practices are: create OUs for groups of users that need different settings, not to mirror the org chart; keep the tree shallow; and use configuration groups for exceptions that cut across OUs.

Birchline's tree, from GCP-210, is a good example: Head office with department children, Warehouses, Stores, Pilot, Contractors, Admin accounts and Departed staff. Stores has four region OUs, created only so that regional coordinators could be given a custom admin role scoped to their stores. That is a legitimate reason for an OU: settings or delegated administration differ. A question that suggests creating an OU for every manager's team, with identical settings, is usually describing a design mistake.

1.3 Groups

Groups do several jobs, and the exam tests whether candidates can tell them apart.

Dynamic groups depend on edition, and Owen marks them as unsure: he has never built one because Birchline uses GCDS to maintain group membership from Active Directory. He adds a note to check which editions include dynamic groups. Group settings such as who can join, who can post, who can view members and whether outside members are allowed are also fair game, because many data-leak scenarios begin with a group that allowed external members.

1.4 Domains

Workspace has three kinds of domain, and the difference is tested often.

Adding any domain requires verifying ownership, usually with a TXT record at the domain's DNS host, and setting MX records if it will receive mail. The exam likes the choice between a secondary domain and a domain alias. If the people are different, with their own accounts, it is a secondary domain. If the same people need another address, it is a domain alias. Primary domain changes are possible but have consequences, so they are seldom the answer to a simple question.

1.5 Buildings and resources

Rooms and equipment are managed as calendar resources, organized by buildings and floors. The guide lists bulk creation of buildings and resources, creating bookable resources, booking permissions, and resource features such as capacity, video equipment, whiteboards and accessibility. Owen created Birchline's rooms in GCP-211 with a CSV upload; for the exam he reviews the order: buildings first, then features, then resources that reference them, because a resource cannot point to a building that does not exist yet.

Booking permissions are set by sharing each resource calendar: who can see it, who can book it, and whether bookings need to be approved. The boardroom at Birchline can be booked only by members of acl-boardroom-bookers, an access group. A question that asks how to stop everyone booking the executive room is answered by changing the resource's sharing, not by deleting the room or writing a policy memo.

Owen's unsure list for section 1

After marking the guide, Owen has six considerations in section 1 marked unsure. He writes each as a question to answer from the documentation over the next two weeks.

• Which editions include dynamic groups, and how are their queries written?
• What is the current name and scope of each migration tool, and which one fits a migration from another cloud mail provider?
• How does third-party automatic provisioning interact with SAML single sign-on, and what happens to a user deleted at the provider?
• How does an Archived User licence differ from suspension in what users and administrators can do with the data?
• What happens to a user's aliases and group memberships when the user is moved to a secondary domain?
• Which resource features can be set in bulk, and how does the CSV for buildings differ from the one for resources?

Sofia adds a seventh: how to transfer calendar event ownership when someone leaves, which sits at the boundary between sections 1 and 2.