Creating a Google Workspace user should follow a repeatable onboarding process so the employee receives the correct identity, services, access, security controls, and support information.
Collect the Approved User Information
Before creating the account, obtain the employee's legal or preferred display name, job title, department, manager, start date, work location, primary email naming format, required applications, device requirements, and access approvals.
Do not create accounts from an informal message when the organization requires an approved onboarding request.
Check for Existing Accounts and Aliases
Search Directory and Groups for the requested email address, prior employee accounts, aliases, contact records, and similar names.
Confirm whether the person previously worked for the organization or whether the requested address belongs to a shared function such as billing or support.
One person should have one primary identity
Use aliases, groups, and delegated access for additional addresses rather than creating unnecessary shared user accounts.
Open the User Creation Page
In the Google Admin console, go to Directory and Users, then choose the option to add a new user. The exact button label can change as Google updates the interface.
Use an administrator role with approved user-management privileges rather than Super Admin when possible.
Enter the Name and Primary Email Address
Enter the employee's first and last name according to company naming standards. Choose the correct domain when the organization has more than one domain.
Verify spelling carefully. The primary email address becomes the user's sign-in identity and is used across Gmail, Drive, Calendar, Meet, Chat, and connected applications.
Set the Initial Password
Google can generate a temporary password or allow the administrator to set one. Require the user to change it at first sign-in unless an approved onboarding method provides another secure process.
Do not send the username and temporary password together through ordinary email. Verify the employee's identity before providing credentials.
Never place permanent passwords in tickets or shared documents
Use temporary credentials and an approved secure delivery process, then require the employee to establish a private password.
Select the Correct Organizational Unit
Place the user in the organizational unit that applies the correct service, security, device, sharing, and application settings.
Do not leave every employee in the top-level organizational unit when the organization intentionally uses child organizational units for policy differences.
Understand Policy Inheritance
A user normally inherits settings from the assigned organizational unit and its parent structure. A lower-level override or supported configuration group may change the final result.
Document the intended organizational unit and verify the user received the expected Gmail, Drive, Calendar, Meet, and security settings.
Assign the Correct License
Confirm whether licenses are assigned automatically by organizational unit or manually to the user. Verify the Google Workspace edition and any additional subscriptions required for the role.
A license can control Gmail, storage, security, meeting, retention, and administrative features. Do not assign a more expensive license without a documented need.
Review Automatic Licensing
Automatic licensing can simplify onboarding, but the organizational-unit rule must be correct. A user moved to another organizational unit may receive a different automatic license outcome.
Review assignment after transfers, mergers, contractors, leave, and role changes.
Add Group Membership
Add the user to approved email, department, security, access, shared-drive, Calendar, application, and workflow groups.
Use a role-based access matrix or onboarding checklist. Copying another employee's groups without review can reproduce excessive or outdated access.
Assign Group Ownership Carefully
Group owner and manager roles can change membership, settings, posting, and access. Assign these roles only when the employee has an approved operational responsibility.
Ensure each critical group has more than one current owner.
Add Email Aliases
An alias provides another email address that delivers to the user's primary mailbox. Use aliases for name variations, former addresses, or approved role-related addresses when individual delivery is appropriate.
Use a Google Group, collaborative inbox, or delegated mailbox workflow when multiple employees need access to an address.
Configure the Directory Profile
Review job title, department, manager, employee identifier, work location, phone number, and other directory attributes used by the organization.
Directory information can appear in contacts, Calendar, profile cards, applications, and integrations. Apply privacy and accuracy standards.
Prepare 2-Step Verification
Confirm whether the user can enroll before enforcement and which methods are approved. Include 2-Step Verification in first-day onboarding.
High-risk users may require security keys or passkeys. Document recovery and lost-device support.
Review Application Access
Determine which Google Workspace services, additional Google services, Marketplace applications, single sign-on applications, and OAuth applications the employee needs.
Do not allow broad third-party application access merely because the user has a Google Workspace account.
Prepare Drive and Shared Drive Access
Add the employee to approved shared drives and Drive-access groups. Use the minimum role required, such as viewer, commenter, contributor, content manager, or manager according to the workflow.
Avoid transferring organizational documents into the employee's My Drive when a shared drive is the correct business location.
Prepare Calendar and Resource Access
Add access to shared calendars, room resources, equipment calendars, appointment schedules, or department calendars as approved.
Review whether the employee can see event details, create events, modify events, or manage sharing.
Prepare Gmail Access
Review delegation, group addresses, send-as permissions, routing needs, signatures, and approved forwarding.
Do not create a shared password for a departmental mailbox. Use groups, delegation, or another supported collaborative method.
Prepare Device Access
Determine whether the employee receives a company-owned computer or mobile device and whether enrollment, endpoint verification, screen locking, encryption, or management is required.
Coordinate the account start time with device setup so the user does not sign in from an unmanaged device before the intended controls apply.
Configure First-Day Communication
Provide the sign-in address, temporary credential delivery instructions, 2-Step Verification steps, device instructions, support contact, password guidance, phishing guidance, and expected applications.
Tell the employee that support will not ask for a password, backup code, or unexpected verification approval.
Test the User Experience
Validate the account status, license, organizational unit, groups, aliases, services, 2-Step Verification enrollment, shared-drive access, Calendar access, and device enrollment.
Document any settings that can take time to propagate and schedule follow-up validation.
Record the Completed Onboarding
Keep evidence of the request, approval, account name, domain, organizational unit, licenses, groups, aliases, devices, applications, completion time, and administrator.
Do not record the final private password.
Plan for Future Changes
The account must be updated when the employee changes name, manager, department, job role, location, device, or employment status.
Use the same approved change process rather than allowing settings and group access to become outdated.
User Account Creation Checklist
- Obtain an approved onboarding request.
- Check existing users, aliases, and groups.
- Create the user with the correct name and domain.
- Use a temporary password and secure delivery.
- Place the user in the correct organizational unit.
- Assign or verify the correct licenses.
- Add approved group memberships.
- Configure aliases and directory attributes.
- Prepare 2-Step Verification.
- Assign Drive, Calendar, Gmail, and application access.
- Coordinate device enrollment.
- Validate and document the completed setup.
Frequently Asked Questions
Should I copy another employee's groups?
Use the employee as a reference only. Review every group against the new user's approved job responsibilities.
Should a departmental email address be a user account?
Often a group, collaborative inbox, or delegated access model provides better accountability than a shared password.
Can a user be in more than one organizational unit?
No. A user belongs to one organizational unit at a time, though groups can apply additional access or supported configuration settings.
When Professional Support Helps
Professional support can create the onboarding workflow, configure organizational units and licensing, build group-based access, prepare security enrollment, and validate new-user setup.
Need help applying this?
Manage Google Workspace with confidence.
J3 Systems Group LLC can configure the Admin console, administrator roles, users, organizational units, groups, licensing, service settings, and supporting administration procedures.