Workspace Admin · Domain 1 of 6

Workspace Admin Domain 1: Managing user accounts, domains, and Directory

This section covers the Directory side of the Admin console: creating, syncing, suspending and deleting users, designing the organizational unit tree, building groups, adding domains, and setting up buildings and bookable resources.

Exam weight
~20%
Official objectives
5
Estimated questions estimate
11
Suggested study time estimate
10–14 hrs

About 15 min read Reviewed October 2026

Overview

Section 1 of the Associate Google Workspace Administrator exam is about the objects every other setting attaches to. You need to know how accounts are created by hand, in bulk, through Google Cloud Directory Sync (GCDS) or Directory Sync, or by a third-party identity provider, and what happens when an account is suspended, deleted, restored or moved to an Archived User license. It also covers organizational unit (OU) design, the different kinds of groups, primary and secondary domains versus domain aliases, and buildings, rooms and other calendar resources.

This Associate exam replaced the Professional Google Workspace Administrator certification, which Google retired on 31 December 2024, and the guide now expects daily operational skill rather than architecture. Expect short scenarios about a new hire, a leaver, a merger that brings a new domain, or a team that needs a shared inbox.

How it's tested

Section 1 questions read like help desk tickets and admin change requests. A user is leaving, a company is acquired, a team wants a shared mailbox, or a meeting room must only be booked by managers. You pick the Admin console action that meets the requirement with the least risk to data and the least manual upkeep.

  • Offboard without losing data

    A leaver scenario asks whether to suspend, delete, transfer Drive ownership, or assign an Archived User license before removing access.

  • Choose the right container

    A policy difference is described, and you decide whether an OU, a configuration group or a security group is the right place to apply it.

  • Domain and address changes

    A merger or rebrand needs new addresses, and you choose between a secondary domain, a domain alias or a user alias.

Reasoning it through

A sales manager resigns and HR asks that her mail stay discoverable for litigation while her Drive files go to her replacement. Deleting the account immediately removes her data from Vault coverage. Suspending her keeps the data but still uses a full license. The defensible path is to transfer her Drive files to the replacement, then switch her to an Archived User license so Vault retention and holds continue at lower cost.

Objectives 5

Official objectives from the Google Cloud outline, in outline order.

1.1 Managing the user life cycleProvisioning, sync, SSO, account changes, licenses and passwords.
What it means
This objective covers the whole life of an account: choosing a migration and provisioning approach, creating users manually or in bulk, automating provisioning through GCDS, Directory Sync or a third-party identity provider, configuring basic SAML single sign-on, editing names, primary addresses and aliases, assigning licenses, and handling password resets. It ends with suspension, deletion, restore, archiving and Drive ownership transfer.
What to understand
GCDS runs on a server and pushes users and groups one way from LDAP or Active Directory into Google; Directory Sync does a similar job from the Admin console for Active Directory and Microsoft Entra ID without a local server. When a third-party IdP is the source of truth, it provisions accounts through SCIM-style connectors and handles authentication through SAML. A suspended user cannot sign in but keeps data and normally a license. A deleted user can be restored for about 20 days. Archived User licenses keep data for retention at lower cost.
How it shows up
Expect a joiner, mover or leaver scenario where you choose sync, suspend, delete, archive or transfer.
Common confusion
Treating suspension as a cost saving; a suspended account usually still holds its paid license.
1.2 Designing and creating organizational units (OUs)OU hierarchy design and Google best practices.
What it means
This objective is about building the organizational unit tree that settings inherit through. You design the hierarchy, follow Google's recommended practices, and create and manage OUs that contain users and other objects such as Chrome devices and browsers.
What to understand
Each user belongs to exactly one OU, and child OUs inherit settings from their parent unless an admin overrides them. Good designs group people by the settings they need, such as contractors who cannot share externally, rather than copying the org chart. Keep the tree shallow, avoid one OU per person, and use configuration groups for exceptions that cross OUs. Moving a user to another OU changes the policies they receive.
How it shows up
A group of users needs different settings, and you choose whether a new OU, a child OU or a group is cleanest.
Common confusion
Thinking a user can sit in two OUs at once; OU membership is single, group membership is multiple.
1.3 Managing groupsDistribution lists, collaborative inboxes, dynamic and security groups.
What it means
This objective covers designing a group structure and creating groups for different jobs: distribution lists for mail, shared mailboxes using the Collaborative Inbox feature, dynamic groups whose membership comes from a user attribute query, and security groups used for access control.
What to understand
Groups can be nested and a user can be in many groups, which makes them the flexible complement to OUs. Group settings control who can post, view members and join. A Collaborative Inbox lets members assign and resolve conversations sent to a shared address. Dynamic groups update membership automatically from directory attributes such as department. Applying the security label to a group is permanent and signals that the group grants access to resources.
How it shows up
A team needs a shared address, automatic membership, or an access-control group, and you choose the group type and settings.
Common confusion
Expecting to remove a security label later; once a group is labelled as a security group, the label cannot be removed.
1.4 Managing domainsPrimary and secondary domains, verification and domain aliases.
What it means
This objective covers adding and verifying primary and secondary domains, and creating domain aliases, so that users receive the right email addresses after a merger, a rebrand or the purchase of extra domain names.
What to understand
Every domain must be verified, usually with a TXT record at the DNS host, before it can be used. A secondary domain lets you create separate users whose primary address is on that domain, which suits an acquired company keeping its own identity. A domain alias gives every user in the primary or secondary domain an extra address automatically, at no extra cost. A user alias is a single extra address on one account.
How it shows up
A merger or rebrand is described, and you choose a secondary domain, a domain alias or user aliases.
Common confusion
Confusing a domain alias with a secondary domain; an alias adds addresses, a secondary domain hosts separate users.
1.5 Managing buildings and resourcesBuildings, rooms, bookable resources, features and permissions.
What it means
This objective covers creating buildings and rooms individually or in bulk, adding bookable resources such as equipment, describing resource features like capacity, a whiteboard or wheelchair access, and setting who is allowed to book each resource.
What to understand
Buildings and floors are defined first, then rooms and other resources are attached to them, often by uploading a CSV for large sites. Features and capacity help users find suitable rooms when scheduling. Booking permissions are set by sharing the resource calendar: users who can only see free and busy can request it, while restricted resources can be limited to a group such as executives. Rooms appear in Calendar's room finder once created.
How it shows up
A room must be bookable only by one team, or many rooms must be added at once, and you choose the method.
Common confusion
Trying to restrict a room through OU settings rather than through the resource calendar's sharing permissions.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Google Cloud Directory Sync (GCDS)

    A server-based tool that syncs users and groups one way from LDAP or Active Directory into Google.

    Remember
    It never writes changes back to the source directory.
    Tested as
    Provisioning and migration scenarios.
    Trap
    Expecting edits in Google to flow back to Active Directory.

  • Directory Sync

    An Admin console feature that syncs users and groups from Active Directory or Microsoft Entra ID without installing GCDS.

    Remember
    It is a newer, hosted alternative to GCDS.
    Tested as
    Sync tool selection questions.
    Trap
    Assuming a local server is always required.

  • SAML single sign-on

    Lets a third-party IdP authenticate users signing in to Google.

    Remember
    Sign-in policy can be assigned by OU or group through SSO profiles.
    Tested as
    SSO and IdP scenarios.
    Trap
    Thinking SSO also creates accounts; provisioning is a separate function.

  • Suspend vs. delete

    Suspend blocks sign-in and keeps data; delete removes the account and its data after a short restore window.

    Remember
    Deleted users can be restored for about 20 days.
    Tested as
    Offboarding questions.
    Trap
    Deleting before transferring Drive files.

  • Archived User license

    A lower-cost license that keeps a former employee's data for Vault retention and holds.

    Remember
    The account cannot sign in or use services.
    Tested as
    Leaver and litigation scenarios.
    Trap
    Leaving the leaver suspended on a full license for years.

  • Data transfer

    Moves Drive and other data ownership from one user to another in the Admin console.

    Remember
    Run it before deletion, or choose it during the delete flow.
    Tested as
    Offboarding sequencing.
    Trap
    Assuming Drive files are kept automatically after deletion.

  • Organizational unit inheritance

    Child OUs take their parent's settings unless overridden.

    Remember
    A user lives in one OU only.
    Tested as
    Policy targeting questions.
    Trap
    Building one OU per department regardless of policy needs.

  • Configuration groups

    Groups used to apply certain service settings across OU boundaries.

    Remember
    Group-based settings take precedence over OU settings for the same service.
    Tested as
    Exception handling.
    Trap
    Creating a new OU for a small cross-department exception.

  • Collaborative Inbox

    A group feature that lets members assign, track and resolve conversations sent to a shared address.

    Remember
    It is enabled on a group, not on a user mailbox.
    Tested as
    Shared mailbox scenarios.
    Trap
    Choosing mail delegation for a whole team.

  • Dynamic groups

    Groups whose membership is defined by a query on user attributes.

    Remember
    Membership updates automatically and requires a supporting edition.
    Tested as
    Automation scenarios.
    Trap
    Expecting to add members by hand.

  • Domain alias

    An extra domain whose addresses are added for every user of the domain it aliases.

    Remember
    No new user accounts are created.
    Tested as
    Rebrand questions.
    Trap
    Using it when the acquired staff need separate accounts.

  • Resource booking permissions

    Controlled through the sharing settings of the resource calendar.

    Remember
    Restrict booking to a group by limiting who can book.
    Tested as
    Room scenarios.
    Trap
    Looking for a room restriction in OU settings.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Suspend vs. delete vs. archive

ConceptMeaningKey differenceCommon trap
Suspend Blocks sign-in and keeps all data Reversible; license usually still billed Using it as long-term storage
Delete Removes the account and its data Restore window of about 20 days Deleting before a data transfer
Archived User license Keeps data for retention without sign-in Lower cost, Vault coverage continues Forgetting that Vault coverage ends when the account is deleted

Secondary domain vs. domain alias vs. user alias

ConceptMeaningKey differenceCommon trap
Secondary domain Hosts users whose primary address is on that domain Separate identities Using it to add a second address to everyone
Domain alias Adds an address on the alias domain for every user No new accounts Using it when staff need distinct accounts
User alias One extra address on one account Per user, manual Creating hundreds of aliases instead of a domain alias

OU vs. group

ConceptMeaningKey differenceCommon trap
Organizational unit Policy container; each user is in exactly one Settings inherit down the tree Trying to place a user in two OUs
Group Collection of users, possibly nested Mail, sharing, access and some setting targeting Assuming groups can carry every OU setting

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Delete to save money

    What candidates pick
    Delete the leaver's account the day they leave to free the license.
    Why it looks right
    It frees the license at once.
    Why it's wrong
    Deletion ends Vault coverage and removes Drive files unless they were transferred first; an Archived User license keeps data cheaply.

    Clue to watch for Legal or a manager still needs the user's data.

  2. Second OU for one exception

    What candidates pick
    Create a new OU for five people in different departments who need one setting changed.
    Why it looks right
    OUs are the familiar policy container.
    Why it's wrong
    Moving them breaks their other department settings; a configuration group can target the exception across OUs.

    Clue to watch for Members are spread across several departments.

  3. Secondary domain for a rebrand

    What candidates pick
    Add the new brand as a secondary domain and recreate accounts.
    Why it looks right
    It sounds like the formal way to add a domain.
    Why it's wrong
    The goal is extra addresses for existing users, which a domain alias provides without new accounts.

    Clue to watch for Every existing user needs an address on the new name.

  4. Delegation for a team inbox

    What candidates pick
    Grant mail delegation on one user's mailbox to the whole support team.
    Why it looks right
    Delegation already shares a mailbox.
    Why it's wrong
    Delegation ties the inbox to a person; a group with Collaborative Inbox lets members assign and track conversations on a shared address.

    Clue to watch for A team needs to assign and resolve customer emails.

  5. Two-way sync

    What candidates pick
    Rely on GCDS to update Active Directory when users change their phone number in Google.
    Why it looks right
    Sync sounds bidirectional.
    Why it's wrong
    GCDS is one way from LDAP to Google; Active Directory stays the source of truth.

    Clue to watch for The source directory is on premises.

  6. Room restriction by OU

    What candidates pick
    Block the boardroom for everyone except executives through an OU setting.
    Why it looks right
    Most policies live in OUs.
    Why it's wrong
    Booking rights come from the resource calendar's sharing, so you share booking rights with the executive group only.

    Clue to watch for Only one team may book a specific room.

Answer framework

Use these steps for any Section 1 scenario about accounts, containers, domains or rooms.

  1. Identify the object involved: a user account, an OU, a group, a domain or a calendar resource, and whether the change is a joiner, mover or leaver event.
  2. For provisioning, find the source of truth first; Active Directory or LDAP points to GCDS or Directory Sync, while a cloud identity provider points to its own provisioning connector plus SAML.
  3. For leavers, protect data before removing access: transfer Drive files, keep mail for Vault, then archive or delete.
  4. For policy targeting, use an OU when the whole population differs and a group when the exception crosses OUs.
  5. For new addresses choose the lightest option that works, moving from a user alias to a domain alias to a secondary domain, and for rooms set booking rights through resource calendar sharing.

Practice question

An engineer is leaving next week. Her manager needs her Drive files, and legal requires that her email remain searchable in Vault for two years. The company wants to stop paying for a full license. What should the administrator do?

Want more like this? The Workspace Admin practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with a test tenant, or the Admin console help center if you have no tenant, and walk through a full user lifecycle: create a user, add an alias, move them between OUs, reset the password, transfer their Drive files, suspend, delete and restore. Doing it once makes the order of offboarding steps stick far better than reading about it. Then sketch an OU tree for a fictional company with contractors, executives and a regulated finance team, and decide where each difference belongs.

Next, compare the sync and identity options side by side: GCDS, Directory Sync, a third-party IdP with provisioning, and SAML sign-in only. Write one sentence for each saying what it does and which direction data flows. Spend a short session on groups, creating a distribution list, a Collaborative Inbox and a dynamic group, and note which features need specific editions. Finish with domains and resources: verify a test domain, add a domain alias, and upload a small CSV of rooms with capacity and features. Close the section by answering practice questions on leavers and mergers, since those scenarios combine several objectives at once.

FAQ

How much of the Workspace Admin exam is Section 1?

Managing user accounts, domains, and Directory is about 20% of the Associate exam, roughly 11 questions out of 50 to 60.

Is this the same exam as the Professional Google Workspace Administrator?

No. Google retired the Professional exam on 31 December 2024 and replaced it with this Associate exam, which focuses on day-to-day administration. Older Professional prep material is only a partial match.

What is the difference between GCDS and Directory Sync?

Both sync users and groups one way into Google. GCDS is installed on your own server and reads LDAP or Active Directory, while Directory Sync is configured in the Admin console and connects to Active Directory or Microsoft Entra ID without local software.

Does a suspended user still need a license?

In most cases yes. Suspension stops sign-in but the account keeps its license. If you only need to keep the data for retention, an Archived User license is the cheaper option.

Can a user belong to more than one OU?

No. Each user is in exactly one organizational unit. Use groups when a setting or access rule must reach people across several OUs.

When should I add a domain alias instead of a secondary domain?

Use a domain alias when every existing user simply needs an extra address on another domain. Use a secondary domain when you need separate users whose primary address is on that domain.

How do I limit who can book a meeting room?

Change the sharing settings of the room's resource calendar so that only the chosen group can book it, while others can see free and busy or nothing at all.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered the user lifecycle, sync and SSO, OUs, groups, domains and calendar resources. Test whether you can handle joiner and leaver scenarios correctly.

Take the Workspace Admin practice test Check your Workspace Admin readiness

Keep going