Google Workspace: Compare Groups vs Organizational Units

How access groups work

  • Groups turn on user access to core services, Google additional services (such as YouTube), and SAML applications. Groups can’t turn off user access to a service that’s turned on for an organizational unit.
  • An access group can contain any users or groups within your account. You can use your existing groups, for example, [email protected] or [email protected]
  • Access groups control only whether a service is on for a user. You set the service settings (such as Drive sharing) for a a organization unit or configuration groups (available for some services). Learn more
  • You create access groups in the Google Admin console, Google Groups for Businesss, Google Cloud Directory Sync, or Directory API.  Groups created in Google Groups and dynamic groups can’t be used as access groups.  

Compare groups and organizational units

FunctionTurn on servicesConfigure some service settingsTurn on/off servicesConfigure service settings
Service accessTurn service ON for users in the group. Always overrides the organizational unit’s setting.Turn service ON or OFF for users in the organizational unit.
Services supportedCore servicesAdditional Google services (such as YouTube, AdWords)SAML appsCore servicesAdditional Google servicesSAML appsGoogle Workspace Marketplace appsGoogle services without an individual On/Off control
User membershipUsers from different organizational units can belong to a group. Users can belong to multiple groups.A user belongs to a single organizational unit.
InheritanceYes. Groups within a group get access to the service.Yes. Organizational units can inherit or override the parent organizational unit setting.
Automatic user licensingNoYes