What's changed: Created Associate Google Workspace Administrator Chapter 1 (Domain 1 "Users/domains/directory": provisioning and directory = individual/bulk CSV/GCDS/SCIM-API, DNS verification, MX, SPF/DKIM/DMARC; OUs/groups/admin roles = OU hierarchy and policy inheritance, groups, delegation of super admin/predefined/custom roles with least privilege).
1.1User provisioning and the directory
Understand the methods to create Google Workspace user accounts (individual, bulk via CSV, Directory Sync (GCDS)/SSO federation, API/automation) and when to use each, domain and DNS verification (MX, SPF, DKIM, DMARC), and managing the organization directory (the scope of shared contacts and information).
Associate Google Workspace Administrator is for practitioners who run Google Workspace (Gmail, Drive, Calendar, Meet, etc.) day to day, managing users, services, security, and compliance. The foundation is user management—defining who has access.
1.1.1Methods to create users
| Method | When to use |
|---|---|
| Individual (Admin console) | A few users quickly |
| Bulk upload via CSV | Tens to hundreds at once |
| Directory Sync (GCDS) | Sync from on-prem LDAP/AD |
| SCIM / API & automation | IdP federation or continuous automation |
For a few, create individually in the Admin console. For tens to hundreds, bulk upload via CSV is quick. If on-prem Active Directory / LDAP is the source of truth, sync users/groups periodically with Google Cloud Directory Sync (GCDS). To continuously auto-create/suspend from an external IdP, use SCIM or the Admin SDK API. Map "many at once = CSV," "sync from AD = GCDS," "auto from IdP = SCIM/API."
1.1.2Domains and the directory
Prove ownership of your organization domain (e.g., example.com) with a DNS verification record, and point MX records to Google for mail delivery. For anti-spoofing, configure SPF, DKIM, and DMARC (mechanisms that prove sender legitimacy to recipients). The directory manages how far user contact information is shared/visible within the organization. Map "mail delivery = MX," "anti-spoofing = SPF/DKIM/DMARC," "ownership = DNS verification."
Common: requirement → means. E.g., "create hundreds at once" = bulk CSV; "sync from on-prem AD" = GCDS; "auto create/suspend from IdP" = SCIM/API; "be able to receive mail" = MX; "anti-spoofing" = SPF/DKIM/DMARC; "prove domain ownership" = DNS verification record.
Watch the mix-ups: (1) GCDS syncs AD→Workspace (distinct from IdP SSO). (2) MX delivers mail, while SPF/DKIM/DMARC are anti-spoofing—different roles. (3) For deletion, consider suspend first given restore and data-transfer needs.
1.1.3Section summary
- User creation = individual/bulk CSV/GCDS (AD sync)/SCIM-API (IdP auto), chosen by scale and source
- Domains: DNS verification proves ownership, MX delivers mail, SPF/DKIM/DMARC counter spoofing
- The directory manages the sharing scope of contact information
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To create hundreds of users at once, which is the quickest method?
Q2. To sync users into Workspace using on-prem Active Directory as the source of truth, what do you use?
Q3. Which DNS record do you set so the organization can receive mail?
Q4. Which combination is configured for email anti-spoofing?
Q5. To continuously auto-create/suspend users via an external IdP, which method best fits?
Q6. For a departing user whose data you want to retain/transfer for now, which first step is most appropriate?