
Google Workspace Implementation & Setup
Buying licences gives you an empty tenant. Implementation is the work that turns it into a system your organisation actually controls — structure, policy, security and access, built once and documented.
Almost anyone can create users and point an MX record. What decides whether Google Workspace still works for you in two years is whether the organisational structure supports the policy you need, whether files are owned by the company rather than by individuals, and whether anyone wrote down why it was set up that way.
What you end up with
- account_treeA structure that supports policyNot every user in one undifferentiated bucket
- folder_sharedFiles owned by the companyAccess does not leave when a person does
- shield_lockA security baseline that is enforced2SV, admin separation, deliberate sharing rules
- descriptionDocumentation you can work fromIncluding why each decision was made
Where implementation starts and stops
These three words get used interchangeably in quotes, which makes comparing them harder than it should be. Here is how we separate them, so you can see exactly what you are being quoted for.
| Stage | The question it answers | What it covers |
|---|---|---|
| Consulting | Should we do this, and with what? | Assessment of what you run today, whether Google Workspace is the right fit at all, which edition your storage and compliance position requires, and what the move would involve. Advisory, before a decision is made. |
| ImplementationYou are here | Build it properly, once. | Domain and DNS, organisational and group structure, Shared Drive design, sharing policy, the security baseline, admin roles, endpoint rules and the rollout itself. |
| Migration | Move what already exists. | Copying mail, contacts, calendars and files from your current system, planning the cutover and the MX switch, and handling deliverability. Runs alongside implementation on most projects. |
On most projects implementation and migration run together, because there is little point moving data into a tenant whose structure has not been decided yet.
What actually gets configured
Seven areas. None of them are exotic, and all of them are things a tenant bought direct simply does not have until somebody sits down and decides them.
Domain and identity
- check_circleDomain ownership verified, and secondary or regional domains added where the business genuinely uses them
- check_circleMX records planned, with the switch scheduled rather than improvised
- check_circleDomain aliases configured so a second brand or spelling delivers to the same people
- check_circleUser accounts created with a naming convention that will still make sense at three times the headcount
Organisational structure
- check_circleOrganisational units that reflect how policy actually needs to differ — by site, department or role, not by org chart vanity
- check_circleGroups separated by purpose: mailing groups people write to, and security groups that grant access
- check_circleNaming conventions agreed up front, because renaming a group that is already granting access is far harder than naming it correctly
Mail configuration
- check_circleShared addresses like sales@ or accounts@ configured as groups or delegated mailboxes, matching how the team really works
- check_circleAliases and forwarding rebuilt deliberately, which doubles as an audit of every forward still pointing at someone who left
- check_circleCatch-all policy decided — usually switched off, because a catch-all is a spam magnet more often than a safety net
- check_circleRouting and compliance footers where a regulator or a client contract requires them
Drive and sharing
- check_circleShared Drives designed around how work is organised, and owned by the organisation rather than by whoever created the folder
- check_circleExternal sharing policy set deliberately — open, restricted to allowlisted domains, or off — instead of left at whatever the default happens to be
- check_circleLink-sharing defaults tightened so a new document is not public to anyone with the URL
- check_circleAccess to the structure verified by the people who will use it, before anyone depends on it
Security baseline
- check_circle2-Step Verification enforced, with a realistic enrolment window rather than an overnight lockout
- check_circleAdmin roles separated so day-to-day tasks do not require super-admin, and more than one person holds recovery access
- check_circleThird-party app access reviewed, so an OAuth prompt cannot quietly hand your Drive to an unvetted tool
- check_circleSession length and recovery options set to match how sensitive the data actually is
Each control, and which editions have it, is set out separately on Google Workspace security
Devices and endpoints
- check_circleA decision on whether personal phones may reach company mail, and what that permits you to do if one is lost
- check_circleScreen lock and encryption requirements applied at the level your edition supports
- check_circleThe scope of a remote wipe agreed in writing, because the difference between wiping a device and wiping an account matters to the person holding the phone
Deliverability
- check_circleSPF, DKIM and DMARC published and verified as part of the build, not left as a follow-up nobody owns
- check_circleDKIM in particular is generated and published deliberately — Google Workspace does not sign outgoing mail by default
Covered in depth on the migration page, since that is where it most often goes wrong. Google Workspace migration
Six decisions only you can make
These are the questions that genuinely slow an implementation down, and none of them are technical. We will explain what each option does and what it costs you in convenience — but a consultant who answers them for you is guessing at your risk appetite.
How open external sharing should be
An architecture firm sharing drawings with contractors needs a different answer from a clinic handling patient records. We will tell you what each setting does and what it costs you in friction — the risk appetite is yours.
Who holds super-admin
Our recommendation is more than one person and fewer than four, none of them using that account for daily work. Who those people are is a question about trust and succession inside your business, not a technical one.
Whether personal devices reach company data
Allowing it is convenient and popular. It also means agreeing in advance what happens to someone's phone when they leave or lose it. Better settled now than during the incident.
How long data is kept
Retention has a cost and, in some sectors, a legal floor. This one decides your edition as well as your policy, so it belongs at the start rather than after the licences are bought.
What happens to a leaver's account
Deleted, suspended, or archived with the mail retained and the files reassigned. Most organisations have never decided this explicitly, and discover the gap the week someone resigns.
How the structure maps to the business
By department, by site, or by function. It sounds cosmetic and is not — the structure decides how granular your policy can ever be, and reorganising it later means moving live accounts.
Three ways to put it live
The build is the same in each case. What changes is how many people meet it on the same morning, and therefore how concentrated the risk and the support load are.
Everyone at once
Suits
Small, single-site organisations with one source system and straightforward requirements.
Trade-off
Fastest and cheapest. Everyone shares the same experience on the same day, which makes support easy to concentrate — and makes a bad day universal.
Pilot first, then everyone
Suits
Most organisations. The default recommendation.
Trade-off
A small group moves a week or two early, including at least one person who will say so loudly if something is wrong. Problems surface where fixing them is cheap, and the pilot group becomes the informal support layer for everyone else.
Phased by department or site
Suits
Larger organisations, multiple locations, or several source systems.
Trade-off
Lowest risk per step, longest overall. It requires a coexistence period where two systems are both live, which is more work to run but means no single day carries the whole risk.
Fixing a tenant that was never set up properly
A good share of the implementation work we do is not a new tenant at all. It is an account bought direct three years ago, configured by someone who has since left, and running on defaults nobody chose. If several of these describe your setup, it is worth a look.
- warning
Super-admin sits on one person's account, with no second holder and no recovery path
- warning
Every user is in a single organisational unit, so any policy is all-or-nothing
- warning
External sharing was never configured and is wide open by default
- warning
Company files live in personal Drive accounts, so access leaves when the person does
- warning
Shared addresses were created as full licensed users that several people sign into
- warning
DKIM was never published, so outgoing mail is authenticated more weakly than it should be
- warning
There is no offboarding process, and suspended accounts are still consuming licences
Remediation is scoped like an implementation but sequenced far more carefully, because people are already working in the system. Changes have to land without breaking access anyone depends on that day, which usually means a staged plan rather than a weekend of switch-flipping.

What finished actually looks like
Implementations are usually declared complete on the day everyone can sign in. That is the least interesting of the three milestones below, and the only one most projects ever measure.
Day one
- check_circleEveryone can sign in, and knows how
- check_circleMail is flowing to the right addresses
- check_circleShared Drives exist and the right people can reach them
- check_circle2-Step Verification enrolment has started
Day thirty
- check_circleShared Drives are genuinely being used, not just present
- check_circleGroup membership is correct because real use has exposed the gaps
- check_circleSupport questions have tailed off to a trickle
- check_circle2-Step Verification is enforced rather than encouraged
Day ninety
- check_circleThe sharing policy is holding without a growing list of exceptions
- check_circleLicence count has been right-sized against real usage
- check_circleYour own people are making routine admin changes from the handover documentation
- check_circleNobody is still keeping a parallel copy of anything on a personal account
What you are left holding
An implementation that only exists in the head of the person who did it is not finished, whoever that person works for. The test is simple: if we stopped answering the phone tomorrow, could your team still run this?
Admin documentation
Who holds which admin role and why, how the organisational units and groups are arranged, and what each policy decision was meant to achieve. The reasoning matters more than the settings — settings you can read off a screen.
A DNS record map
Every record we touched, what it is for, and where it is hosted. This is the document people wish they had two years later when the registrar login has changed hands twice.
An offboarding runbook
The exact sequence for removing someone: what to suspend, what to transfer, what to archive and what to delete. Written down, so it does not depend on whoever happens to be available.
A named contact
Someone who already knows how your domain, structure and policy are configured, so you are not explaining the background again to whoever answers a queue.
The super-admin accounts are yours throughout. We keep whatever access you want us to keep for ongoing support, and none at all if you would rather run it in-house.
Google Workspace implementation — common questions
helpWhat does Google Workspace implementation actually involve?
expand_more
Verifying your domain and planning the DNS and MX changes; creating users with a naming convention that will scale; building the organisational unit and group structure that policy depends on; designing Shared Drives owned by the organisation rather than by individuals; setting the external sharing policy deliberately; applying a security baseline including 2-Step Verification and admin role separation; deciding endpoint rules; and publishing SPF, DKIM and DMARC. Then rolling all of it out without interrupting trading, and handing over documentation your own people can work from.
helpHow is implementation different from migration?
expand_more
Implementation builds the system: structure, policy, security and access. Migration moves what you already have into it — mail, contacts, calendars and files from your current platform. On most projects the two run together, because there is no point migrating data into a tenant whose structure has not been decided. If you are starting genuinely fresh with no existing system, you need implementation and no migration at all.
helpHow long does a Google Workspace setup take?
expand_more
The technical build of a straightforward tenant is a matter of days rather than weeks. What sets the real timeline is how quickly the decisions get made on your side — how open sharing should be, who holds admin, whether personal devices are allowed, how long data is kept. Organisations that answer those in a single session are live far sooner than ones that answer them over a month, regardless of size.
helpCan you fix a Google Workspace account that is already set up badly?
expand_more
Yes, and it is a common request. The usual picture is a tenant bought direct and never configured: everyone in one organisational unit, external sharing wide open, super-admin on a single personal account, company files sitting in individual Drives and DKIM never published. Remediation is scoped like an implementation but sequenced more carefully, because people are already working in it and changes have to land without breaking access they rely on today.
helpWill our team be disrupted during the rollout?
expand_more
Very little, if it is sequenced properly. Most of the configuration happens before anyone is moved, and the recommended approach moves a small pilot group a week or two ahead of everyone else. The moment that genuinely needs coordinating is the mail cutover, which is scheduled for a quiet window. What causes disruption is not the technical work — it is people arriving on Monday to changes nobody warned them about.
helpDo you set up Shared Drives, or do we?
expand_more
We build the structure, but you decide what it should be, because it has to match how your work is actually organised rather than how an outsider guesses it is. In practice we run a short session to map out how files are grouped and who needs access to what, then build and populate it. Getting this right during implementation is far cheaper than moving thousands of files between Shared Drives later.
helpWhat if we only need a few users set up?
expand_more
Then say so, and we will be straightforward about whether you need us. A three-person team that only wants domain email can reasonably do the setup themselves, and we would rather tell you that than sell you a project. Implementation earns its cost where structure, policy, compliance or staff turnover are genuinely in play.
helpDo you provide training as part of the implementation?
expand_more
A short, role-specific session at rollout is part of the work — what changed for that person, where their files now live, and how Shared Drives differ from emailing attachments. It is deliberately not a product tour. Deeper adoption training is available separately for organisations that want it, but the brief version at cutover prevents most of the support load that follows.
helpWho owns the admin account at the end?
expand_more
You do, always. The super-admin accounts belong to your organisation, and the handover documentation sets out who holds which role and how to recover access. We keep whatever access you want us to keep for ongoing support, and none if you would rather run it yourselves.
helpWhat does an implementation cost?
expand_more
It is scoped on user count, how much structure is genuinely needed, and whether a migration runs alongside it. We quote it as an explicit line next to the licences rather than folding it into a rate, so you can see what each part costs. The requirement call and the quote are free.
Related pages
Google Workspace Services
What the suite includes, and everything else we do with it.
Google Workspace Migration
What moves, what does not, and how the cutover is planned.
Google Workspace Pricing in India
List prices in INR, what GST adds, and what drives the final figure.
Talk to Our Team
Book a free requirement call and get a scoped implementation plan.
Get a Google Workspace consultation
Tell us how many users you have and whether this is a new setup or an existing tenant that needs sorting out. You will get back a scoped implementation plan, a rollout approach, and a fixed-scope figure in INR before anything starts.
- check_circle
Structure and policy designed before anyone is moved
- check_circle
Security baseline applied, not left on defaults
- check_circle
Rollout sequenced around your trading hours
- check_circle
Documented handover, so you are not dependent on us
We build these for businesses across Kerala and the rest of India. Or call +91 99467 89916 or email admin@techgeum.com.