Domain 1: Managing user accounts, domains, and Directory
- The organizational unit (OU) hierarchy is the primary way to scope settings: child OUs inherit from the parent, and a setting applied to a child overrides the inherited value for users in that OU.
- Configuration groups (and groups as an access/policy target) let you apply settings or licenses to users across different OUs without moving them, layering on top of OU-based configuration.
- Provision users by manual creation, bulk CSV upload, Google Cloud Directory Sync (GCDS) from an LDAP/Active Directory source, the Admin SDK Directory API, or automated provisioning from an identity provider.
- GCDS performs one-way synchronization from your directory to Google Workspace, matching users, groups, and org units on a schedule; Google is never the source of truth in that model.
- Manage domains by adding and verifying a primary, secondary, or domain alias; verification uses a TXT/CNAME DNS record, and email routing requires MX records pointing to Google.
- Suspending a user preserves data and licenses while blocking sign-in; deleting a user frees the license and starts a recovery window (about 20 days) before data is permanently removed.
- Transfer a departing user's data (Drive, and with the data-transfer tool other services) to another user before deletion so nothing important is lost.
- Administrative control of Directory settings governs the shared contact directory, profile editing, and visibility of users and groups across the organization.
- Licenses can be assigned manually, by automatic licensing at the OU level, or via groups; a user must have a license for a given service to use it.
- Super Admin accounts should be few, protected with strong 2-Step Verification, and not used for daily work; delegate day-to-day tasks with scoped admin roles instead.
Domain 2: Managing core Workspace services
- Turn services on or off per OU or group under Apps > Google Workspace, so different parts of the organization get different service access.
- Gmail administration includes routing rules, compliance and content filters, the email allowlist/denylist, attachment and spam controls, and setting up SPF, DKIM, and DMARC to authenticate outbound mail.
- Configure Gmail delegation, send-as addresses, and mail-forwarding controls, and use dual delivery or split delivery when integrating with another mail system during migration.
- Drive and Docs sharing settings control external sharing, link sharing defaults, and whether users can publish to the web; shared drives are owned by the organization rather than an individual.
- Manage shared drive membership and roles (Manager, Content manager, Contributor, Commenter, Viewer) and use sharing restrictions to prevent data leaving trusted domains.
- Calendar settings govern external sharing of free/busy and event details, resource (room) management, and appointment scheduling controls.
- Google Meet administration includes who can host, recording and its storage, dial-in, moderation/safety controls, and meeting quality reporting.
- Google Chat and Spaces administration covers external chat, history on/off, file sharing, and whether users can create spaces.
- Use the data-migration tools (or third-party tools) to migrate email, calendar, and contacts from Microsoft Exchange, IMAP, or another Workspace tenant.
- Marketplace apps and third-party access are controlled centrally: allowlist specific apps and manage which OAuth scopes third-party apps may request.
Domain 3: Managing data governance and compliance
- Google Vault provides retention rules and holds for eDiscovery: retention rules keep or purge data by service and time, while holds preserve a user's data regardless of retention or deletion.
- A legal hold in Vault always overrides retention rules and user deletion, ensuring relevant data is preserved for litigation or investigation.
- Vault supports search and export across Gmail, Drive, Chat, Meet recordings, and Groups for eDiscovery, subject to configured retention.
- Data loss prevention (DLP) for Drive and Gmail scans content against predefined or custom detectors (for example credit card or ID numbers) and can block, warn, or quarantine sharing.
- Set OU- or group-scoped DLP rules with actions and severity, and tune detectors and confidence thresholds to reduce false positives.
- Trust rules and sharing restrictions limit external sharing of Drive content to specific trusted domains.
- Data regions let you choose where covered data is stored at rest to meet residency requirements, applied by OU or group.
- Classification labels (Drive labels) let you tag documents and drive policy, including DLP conditions based on a label.
- Compliance features such as content compliance and objectionable-content filters in Gmail enforce organizational messaging policy.
- Retention and deletion behavior differs by service, so map each requirement (Gmail, Drive, Chat) to the correct Vault rule rather than assuming one global setting.
Domain 4: Managing security policies and access controls
- Enforce 2-Step Verification (2SV) by OU or group, and require the strongest available method (security keys/passkeys) for sensitive users; enforcement can include an enrollment grace period.
- Context-Aware Access grants access to apps only when conditions (device policy, IP range, geographic location) are met, enabling zero-trust access control.
- Administrator roles follow least privilege: assign prebuilt roles (for example User Management, Groups, Help Desk) or create custom roles with specific privileges, scoped where possible.
- Session control settings set web session length and reauthentication frequency, reducing risk from unattended sessions.
- Password policy controls minimum length, strength, reuse, and expiration, though strong 2SV is the more important protection.
- The Alert Center surfaces security alerts (suspicious login, government-backed attack warnings, DLP, phishing) and can trigger investigation.
- The security investigation tool (available in higher editions) lets admins search logs and take bulk remediation actions such as suspending accounts or removing files.
- Control OAuth app access and API access so third-party and internal apps only reach approved scopes; block or allowlist connected apps.
- Advanced Protection Program provides the strongest account security for high-risk users, enforcing security keys and stricter checks.
- Login challenges and employee ID or device-based verification add friction for risky sign-ins; understand how to balance security with usability.
Domain 5: Managing browsers and endpoints
- Chrome Browser Cloud Management enrolls managed Chrome browsers and enforces policies (extensions, sign-in, safe browsing, homepage) centrally via the Admin console.
- Manage Chrome extensions by allowlisting, blocklisting, or force-installing them, and control which extensions users may add.
- Endpoint management offers basic mobile management (screen lock, wipe of the account) with no agent, and advanced management (app management, stronger policies, device approval) when enabled.
- Basic mobile management applies passcode requirements and lets you remotely sign out or wipe the Google account from a lost device.
- Advanced mobile management enables device approval, managed apps, and account/full-device wipe, and can require devices to be compliant before access.
- Company-owned device inventory lets you pre-register devices and apply stricter controls than for personal (BYOD) devices.
- Context-Aware Access combined with endpoint management enforces device posture (encrypted, screen lock, approved) as a condition of access.
- Windows, macOS, and mobile devices can be managed to varying degrees; know which capabilities require advanced management or a specific edition.
- Remotely wipe or block a lost device and audit device activity from the Devices section of the Admin console.
- Chrome and endpoint policies, like other settings, are scoped by OU (and group where supported), so target them precisely.
Domain 6: Monitoring and troubleshooting common issues
- Admin console reports (highlights, apps usage, and audit logs) show adoption, security posture, and per-service activity for monitoring and investigation.
- Audit logs (Login, Admin, Drive, Gmail, and others) record who did what and when; use them to trace configuration changes and user actions.
- The Email Log Search tool traces the path and delivery status of specific messages to diagnose delivery, routing, and spam problems.
- Use MX, SPF, DKIM, and DMARC checks (and the Google Admin Toolbox) to troubleshoot mail delivery and authentication failures.
- The Google Workspace Status Dashboard shows service outages, so rule out a platform incident before deep troubleshooting.
- Set up custom alerts and use the Alert Center to be notified of security and configuration events proactively.
- Reproduce a user's problem by checking their OU, group memberships, license, and the effective (inherited plus overridden) settings that apply to them.
- Export reports and logs (or stream logs to BigQuery in supported editions) for longer retention and deeper analysis.
- Common issues - a service missing for a user, blocked sharing, failed sign-in, or undelivered mail - usually trace back to OU/group scoping, 2SV/context-aware access, DLP/sharing rules, or DNS.
- Google support and the Admin console diagnostic tools help escalate genuine platform issues once configuration causes are ruled out.
Associate Google Workspace Administrator exam tips
- Think in the OU and group model first: most 'why can this user (not) do X' questions resolve to which OU the user is in, what settings that OU inherits or overrides, and which groups apply configuration or access on top.
- Know Vault cold: retention rules keep or purge data by service and time, holds preserve data for eDiscovery, and a hold always overrides both retention and user deletion. Do not confuse Vault (governance/eDiscovery) with DLP (preventing risky sharing).
- For security scenarios, reach for 2-Step Verification enforcement, Context-Aware Access (device/IP/location conditions), least-privilege admin roles, and the security investigation tool / Alert Center - and know which capabilities require a higher edition.
- Distinguish basic vs advanced endpoint management: basic is agentless (passcode, account wipe), while advanced adds device approval, managed apps, full-device wipe, and compliance-as-a-condition via Context-Aware Access.
- For troubleshooting, use the right tool: Email Log Search for message delivery, audit logs for who-did-what, the Status Dashboard to rule out outages, and always check the user's effective inherited-plus-overridden settings before assuming a bug.
Study guide FAQ
What is the format of the Associate Google Workspace Administrator exam?
It is a two-hour exam of scenario-based multiple-choice and multiple-select questions taken online-proctored or at a test center. Google reports the result as pass or fail without publishing a fixed numeric score, and the certification is valid for three years.
How much hands-on Admin console experience do I need?
A good amount. The exam assumes you have administered a live Workspace tenant: creating OUs and groups, turning services on and off, configuring Gmail routing and sharing, enforcing 2SV, and reading reports and logs. Practicing in a real or trial Admin console is the best preparation.
What is the difference between Vault and DLP on this exam?
Vault is for data governance and eDiscovery - retention rules and legal holds that keep or preserve data for compliance and investigations. Data loss prevention (DLP) proactively inspects content in Drive and Gmail and blocks, warns, or quarantines risky sharing. Questions often test which one solves a given compliance or data-protection goal.
Do settings apply to organizational units, groups, or both?
Both, and the interaction matters. Settings are primarily scoped by OU with child OUs inheriting from parents and overriding where set. Groups (including configuration groups) layer targeted settings or access on top, which is useful when the affected users span multiple OUs.
Is CertGrid's study guide official Google material?
No. CertGrid is an independent practice platform and is not affiliated with or endorsed by Google. This guide distills the concepts and console workflows the exam emphasizes so you can review efficiently, but always confirm the current objectives on the official Google Cloud certification page before your exam.