Google Workspace Admin Basics for Small Teams

When you sign up for Google Workspace, you become the administrator, whether you meant to or not. The admin console controls who can sign in, what they can share and what happens to company files when someone leaves. You do not need to be an IT professional to run it well. You need a handful of good settings and a simple routine.

Team of colleagues working together around a table with several open laptops — A few admin settings decide how safely the whole team works and shares.

Key takeaways

Keep at least two admin accounts, protect them with strong 2-Step Verification, and use them only for admin work.
Use groups for shared addresses and permissions, and shared drives so files belong to the business, not to individuals.
Enforce 2-Step Verification for everyone and review security alerts and recommendations regularly.
Have a written routine for adding and removing users, so access is granted and revoked the same way every time.

Our comparison of Google Workspace and Microsoft 365 covers which suite to choose. This guide assumes you have chosen Google Workspace and want to run it sensibly. Microsoft 365 has a similar admin center, and most of the principles here apply there too.

Google updates the admin console often, renaming and moving settings. Rather than following exact menu paths, use the search bar at the top of the admin console and check Google's current Workspace Admin Help when something looks different from what you expect.

What the admin console controls

The admin console is a web dashboard, separate from Gmail and Drive, where super administrators manage the whole account. For a small team, the most important areas are:

Users: create accounts, reset passwords, suspend or delete people and assign licenses.
Groups: shared email addresses and permission sets, such as sales@ or a group for everyone in the office.
Organizational units: folders for users that let you apply different settings to different teams.
Security: 2-Step Verification, password rules, alerts and a security health overview.
Apps: settings for Gmail, Drive, Calendar, Meet and other services, including external sharing.
Devices: basic management of phones, tablets and computers that access company data.
Data: export tools, retention and migration options, depending on your edition.

Feature availability varies by Workspace edition, so check which features your plan includes before you plan a setup around them.

Common mistake

Running the whole business through one super admin account that is also the owner's everyday email. If that account is phished or the owner is unavailable, nobody can manage the business. Keep a separate admin account for admin tasks and a second super admin as a backup, both with strong protection.

Set up admin accounts safely

Admin accounts are the keys to everything. Treat them differently from regular accounts.

Create a dedicated admin account. For example, an address used only for administration, not for daily email. Give your normal account regular user rights.
Add a second super admin. A co-founder, trusted manager or IT provider. Two people means no single point of failure.
Use the strongest sign-in available. Protect admin accounts with 2-Step Verification, ideally using passkeys or security keys rather than text message codes.
Add recovery details. Set a recovery phone and email for each admin, so you can regain access if something goes wrong.
Use limited admin roles where possible. If someone only needs to reset passwords or manage groups, give them a narrower role instead of full super admin rights.
Store admin credentials properly. Keep them in a password manager, not a spreadsheet or sticky note.

Users, groups and organizational units

Users

Every person should have their own account. Shared logins make it impossible to know who did what and leave you exposed when someone leaves. Use a consistent naming pattern, such as firstname@ or firstname.lastname@, and decide it before you add the first employee.

Groups

Groups are the most underused tool in Workspace. A group can act as a shared email address that delivers to several people, and also as a permission set for files, calendars and shared drives. Instead of sharing a folder with five individuals, share it with a group. When someone joins or leaves, you change the group membership once and their access updates everywhere.

Common small business groups include info@, sales@, support@, accounts@ and an all-staff group. For customer-facing addresses, consider whether a collaborative inbox setting suits you, so the team can see who replied.

Organizational units

Organizational units (often called OUs) let you apply different settings to different people. A five-person team may need only one. As you grow, you might create separate units for staff, contractors and admin accounts, so contractors get tighter sharing rules than employees, for example.

Pro tip

Create a group for every role-based address before you need it. When a customer has been emailing support@ for two years, that address keeps working even after three different people have handled support. A personal address leaves with its owner.

Colleagues gathered around a laptop on a table, looking together at a phone held by one of them — Groups and shared drives keep access organized as people join and leave.

Shared drives and sharing settings

In regular "My Drive," each file belongs to the person who created it. When that person's account is deleted, their files go with it unless ownership is transferred first. Shared drives solve this: files in a shared drive belong to the organization, so they stay put when people come and go. Shared drives are included in many Workspace editions; check yours.

A simple structure works best for small teams. For example, one shared drive each for Finance, Sales, Operations and Marketing, with access granted through groups.

Setting area	A sensible small business starting point	Why
External sharing	Allow, but warn users when sharing outside the company	Teams need to share with clients, but mistakes should be visible
Link sharing default	Restricted to your organization or named people	Reduces "anyone with the link" files spreading accidentally
Shared drive membership	Managed through groups	One change updates access everywhere
Who can create shared drives	Admins or managers only	Prevents a sprawl of drives nobody owns
Contractors	Separate organizational unit with tighter sharing	Limits what temporary staff can share outward

Common mistake

Keeping every important file in the founder's personal My Drive and sharing folders out from there. It works until the founder leaves the company, changes accounts or loses access. Move core business files into shared drives early, while the volume is still small.

Security settings to turn on first

Google provides a security overview and recommendations in the admin console, sometimes called a security checkup or health page. Start there, then make sure these basics are in place.

Enforce 2-Step Verification. Give staff a grace period to enroll, then make it mandatory. Encourage passkeys or the Google prompt on their phone rather than text message codes.
Turn on alerts. Make sure alerts for suspicious sign-ins, suspended accounts and admin changes reach an inbox someone reads.
Review third-party app access. Many apps ask to connect to Google accounts. Review which apps have access to company data and restrict the ones you do not trust.
Set password rules. Require long passwords and encourage a password manager for everything that is not covered by Google sign-in.
Check email authentication. Set up SPF, DKIM and DMARC for your domain, which the admin console helps with for Gmail.

Devices, data and offboarding

Google endpoint management, included in Workspace, lets you see which phones and computers access company data and apply basic rules, such as requiring a screen lock. Depending on your edition, you can also remotely sign out or wipe company data from a lost device. For teams using personal phones, work profiles can separate business apps from personal ones.

Data export tools let you download a copy of your organization's data, which is useful for backups, audits or leaving Google. The options vary by edition, so check what yours supports before you need it.

Hypothetical example

Imagine a seven-person agency where a project manager resigns. Because client folders live in shared drives and access runs through groups, the admin removes her from two groups, transfers the few files in her My Drive to her manager, sets up email forwarding for a few weeks and suspends the account. The whole process takes under an hour, and no client file goes missing.

Our offboarding checklist covers leaving staff in more detail, including accounts outside Google. Inside Workspace, the core steps are: reset the password and sign the user out of all sessions, transfer Drive files and calendar events, decide what happens to the mailbox, remove them from groups and shared drives, and wipe company data from their devices.

Your Workspace admin checklist

Create a dedicated admin account and a second super admin
Protect admin accounts with passkeys or security keys
Give every person their own user account
Set up groups for role-based addresses and permissions
Move core business files into shared drives managed by groups
Review external sharing and link sharing defaults
Enforce 2-Step Verification for all users
Turn on security alerts and review recommendations monthly
Review connected third-party apps
Write a simple joiner and leaver routine and follow it every time

Frequently asked questions

How many admins should a small business have?

Usually two super admins: enough that one person's absence does not lock you out, few enough that admin access stays tightly controlled. Others who need limited admin tasks can get narrower roles.

Should I delete or suspend a leaving employee's account?

Suspend first, transfer files and decide what to do with the mailbox, then delete when you are sure nothing is needed. Deleting too early can remove data you cannot get back. Check Google's current guidance and your license terms, since suspended accounts may still count toward licenses.

Can contractors use our Workspace?

Yes. You can give them accounts in a separate organizational unit with tighter sharing, or share specific files and shared drives with their own email addresses. Remove access as soon as the project ends.

Is it worth paying an IT provider to set this up?

For a very small team, many owners manage it themselves. If you handle sensitive client data, are regulated or are growing fast, a one-time review of your settings by a Workspace specialist can be good value.

The bottom line

Good Workspace administration is mostly about structure: separate, well-protected admin accounts, groups for access, shared drives for company files and 2-Step Verification for everyone. Set these up once, review security alerts regularly and follow the same routine whenever someone joins or leaves. Your team will barely notice the admin work, which is exactly the point.