Your How-To for Provisioning in G-Suite: Part 2: Users

Ready to jump into the next stage of your G-Suite experience?

Well, before the people in your business can start using your Google services effectively, you'll need to create individual user accounts for each employee. An account on G-Suite is what gives your users their password and username so that they can log into the Google services that you're paying for. Accounts also come with email addresses if you're using Gmail. 

Before you get started, you'll need to make sure that you have enough licensees for your G-Suite account. How you choose to do this will depend on the kind of plan that you use. Google recommends making time to resolve any problems with conflicting accounts before you start adding users to your new account, as this will help to keep future problems to a minimum. 

Provisioning New G-Suite Users Manually

There are various different options that companies can consider when it comes to provisioning users on G-Suite. For instance, you can:

• Manually provision each user one by one or upload larger groups of users at once using a CSV file. 
  
  
• Use Google Cloud directory Sync with LDAP admins for more scalable user provisioning. 
  
  
• Access the Admin SDK Directory API for scalable and flexible provisioning - although this requires more in-depth programming knowledge. 
  
  

Let's start with the easiest option, manually provisioning your users. 

The simplest way to add new people to G-Suite is to add user accounts individually through your Google Admin Console. To get started, log into your Google Admin Console, and make sure that you're signing in with your administrator account. From the Admin Console Home page, click on 'Users' and select the organizational environment that you want to add the new user too. 

You'll see a button at the top of the page that says, 'Add New User', click on that, and you'll be able to fill out a profile for your employee. You can also add a photo for the user if you want to at this point. While adding a photo isn't mandatory, it is a good idea to enter as much information about each user as possible, including:

• Their first and last names
  
  
• Their primary email address - Admin Console recommends using a username that's different from the existing names in your domain. 
  
  
• A different domain if your company has more than one domain. 
  
  
• The organizational unit that the employee is involved with. 
  
  
• A secondary email address that the new account details can be sent to. 
  
  
• A phone number for easier contact options
  
  

Once you've finished filling out your user's profile, you'll need to generate a password for them. Usually, it's a good idea to ask the user to change their password once they sign into their account. Keep in mind that if the account's primary email address matches an existing account with Google, you'll need to resolve this conflict before you can finish adding your new user. 

G-Suite will give you the option to complete a range of other tasks before you finish manually adding the user to your portfolio, such as editing the user's contact and employee information, or adding them to a group. You'll also be able to email login information to your new user or print their details off for them. 

If adding each of your users one at a time seems too exhausting, you can always try adding multiple people at once by uploading their information through a CSV file. 

How to Provision Users for Larger Businesses

If you're a smaller company, adding each of your users into your directory one by one seems simple enough. However, if you are running a business with hundreds of employees, and a lot of turnover, then you probably won't want to take the manual route. With that in mind, it's a good idea to explore alternative options using your LDAP directory. 

The most common solutions offered by G-Suite and Google for larger businesses are:

• Using Google Cloud Directory Sync to move the data from your existing LDAP directory into the Google account that you're updating. 
  
  
• Using the Admin SDK Directory API to access the option for provisioning a larger group of users at once using information from your LDAP directory. This will provide more flexibility than the standard Google Cloud Sync, but it does mean investing in programming knowledge. 
  
  
• Use the G-Suite Migration feature for IBM Notes. 
  
  

For most companies, the easiest option will be to use the Cloud Directory Sync with an LDAP server or Active Directory. This allows businesses to quickly and automatically add, delete, and modify groups, users and contacts. In other words, you can quickly make sure that your Google domain data matches the data in your LDAP or Active Directory Server. 

How to Use the Google Cloud Directory Sync Feature

With the Cloud Directory Sync feature, business admins also get a highly secure experience. Here's how it all works. 

Data from your LDAP or Active Directory server is exported into a list. You'll be able to establish rules and guidelines to specify how your list should be generated. From that point, GCDS will be able to connect to the Google domain and generate a list of Google users, shared contacts, and groups that you can specify individually. GCDS compares the lists and updates the Google domain that you're working on to match the data provided. 

When your sync is finished, Google will email a report straight to you. With this process:

• You ensure that your domain data on Google matches your LDAP or Active Directory server exactly, reducing the risk of unnecessary errors and mistakes.
  
  
• You can configure the rules for a custom strategy for mapping users, non-employee contacts, groups, aliases, user profiles, exceptions, and calendar resources. 
  
  
• The synchronization is a one-way process. There's no access into your LDAP directory server data that goes beyond the perimeters that you set for Google. 
  
  
• Extensive tests and simulations are provided to ensure that the synchronization process runs as smoothly as possible. 
  
  
• All necessary components are included within the installation package as standard, along with a wide variety of features designed to help keep the data in your G-Suite environment secure. 

Top Tips When Provisioning Your User Accounts 

If you're new to provisioning users for your cloud environment, then Google has plenty of useful guidance to offer. For instance, the company recommends taking steps to make your directory as searchable as possible to reduce unnecessary and complicated configurations for GCDS. Additionally, it's worth making sure that you use OU segregation within LDAP to keep identification simple. 

Google recommends using two specific attributes that can be designated to support specific assignments within the deployment process. This process is useful for provisioning cycles. It's a good idea to have these attributes available to avoid change-management problems later in the project. It's also worth keeping in mind that it can take up to 24 hours for a new user account to show up on your searchable G-Suite Directory. With that in mind, make sure that you're patient when it comes to planning your provisioning timeline. 

To keep your provisioning timeline running smoothly, use OUs to quickly migrate larger numbers of users as you need to during important events. You should also make sure that the GCDS is properly scheduled, to make sure that it doesn't interfere with crucial go-live dates. This will help to reduce migration issues and eliminate conflicts within accounts as early as possible. 

Other points to remember when creating accounts include:

• Each account username will become the login name for the person that you're provisioning for, and the first part of their company email address. It might be worth checking the quality of an email address before you finish provisioning a new user. 
  
  
• Each user will be given 30 GB of storage space for their attachments and email automatically when they're signed up for an account with Gmail.
  
  
• After creating an account you will be able to assign the users in your workplace to specific organizational units so that you can control their access to specific features and services. 
  
  

Interestingly, Google allows business leaders to assign up to 30 different 'alternate' email addresses known as aliases to a single user account. Additionally, you will have the option to change the display name of a user when they're signed up, which will change what appears in the messages that the user sends and receives. 

Provisioning your G-Suite Users

Remember that when you sign up for G-Suite, your team will automatically get access to a host of free services, including Photos, YouTube, Google Drive, and more. As an administrator, you'll have the option to add and remove these services by going into the Admin Console and checking the Additional Google Services. Remember that Additional services aren't currently covered by the service level agreements provided by Google - though you can still get help from Google's forums. 

Any user in your team that has additional services enabled will be required to accept a one-time separate Terms of Service agreement. You will be able to set your Admin Console setting for New services to manual if you want to control which additional services become available to your users as innovations roll out from the Google team.