G Suite for Education Quickstart IT Setup Guide

Reference Site: Google Docs

Get your institution set up with G Suite for Education and be on your way to easier collaboration, centralized organization, and streamlined processes.

Setup 101

The following setup guide will help you get started as quickly as possible. For some sections below, we have video tutorials – see this playlist. For more advanced setup information, see Setup 102.

Create your account 

Video Tutorials: Domain Registration, Domain Verification

1. Sign up for G Suite for Education (To see if your organization qualifies, go to Qualifications for G Suite for Education.)
2. During the signup process, you’ll be asked to choose your primary domain.
   1. Please choose a domain to which you have admin access (i.e. access to change DNS records).
   2. Recommended: if needed, you can buy a domain during the signup process. If you buy a domain, you won’t need to verify it in the next step.
3. After completing the signup process, you’ll be given a 14-day trial of G Suite for Education (with a 10 user limit during the trial period). To continue using G Suite for Education, you’ll need to take the following steps as soon as possible:
   1. First, verify your domain, which ensures that no one else is using your domain for Google services without your permission.
   2. Signing up automatically submits your application for an Education upgrade. Please be on the lookout for, and respond to, an email from the Google Cloud Support team (esupport@google.com).

Decide on organizational structure

Video Tutorial: Organizational Units

1. Organizational units let you segment your user population and give different services, settings, and permissions to different users. A well-designed structure is critical to effectively and flexibly manage your G Suite for Education account.
   1. See how an organizational structure works
   2. Get step-by-step instructions for how to add an organizational unit.
   3. Best practices for organizational structure

• The one you decide to use depends on the size of your deployment and organizational needs. 
• Role-oriented structure: In a role-oriented structure, first-level organizational units are organized by role, such as students and teachers. This structure works well if you need to define policies and settings independently of a district or school, and if simple maintenance is a priority.

• Organization-oriented structure: An organization-oriented structure works well when organization and control is a priority. The first-level organizational units are organized by region, district, or school, with policies and settings defined by this structure. Although you have more control, you need a delegated administrator per first-level organizational unit.

Create user accounts

Video Tutorial: Creating Users

Set up user accounts for your students, teachers, and staff

1. We recommend that you create individual user accounts for all students, faculty, and staff who need to access G Suite. We do not recommend sharing accounts or credentials between multiple users.
2. The easiest way to add several users at once is to use CSV uploads. (Follow these username guidelines)

Note: It can take up to 24 hours for new users to have access to G Suite services and appear in the global Directory.

1. For more advanced options for adding users, see Setup 102.
2. Once users are created, you’ll need to distribute their login info (email address and password) offline so they can access their account.

Password Settings

1. Establish password recovery (Higher Education accounts only): to ensure that users can reset their passwords if they forget, set up password recovery.

Note: password recovery only works for Higher Education G Suite for Education domains. If your school type is set to Primary/Secondary Education, password recovery will not work; because younger G Suite for Education users aren’t permitted to add a recovery phone number or email to their account, they can’t reset a forgotten password on their own.

1. Set your users’ password requirements

Enable and set up services

1. (Recommended for fast setup): Disable Gmail and Calendar. Should you wish to enable Gmail and/or Calendar for some or all of your users, please see Setup 102 below.
   1. If you purchase a domain when signing up for G Suite for Education, the MX records will be automatically set to point to Gmail.
   2. If Calendar is enabled, even with Gmail disabled, users can still send calendar invitations to other users within the domain.
2. Classroom
   1. Give teachers and students access to Classroom. If you already use an LMS other than Classroom, sign up for the Assignments beta.
   2. Help instructors get started by creating a class in Classroom.
3. Drive
   1. Enable Drive for your users
4. Hangouts Meet
   1. Use Hangouts Meet advanced features to help users stay connected and work remotely.

Recommended settings for Primary/Secondary Education (K-12) accounts

1. App access control:
   Control which third-party & internal apps access G Suite data and restrict access to G Suite services
2. Drive settings
   1. Recommended sharing permissions for student OUs/groups
      Under “Sharing options,” turn off external file sharing for students (or restrict external sharing to whitelisted domains only) and set “Access checker” to “Recipients only”
   2. Turn off chat in Docs editors
3. Hangouts Meet settings
   1. We recommend that K-12 schools only allow faculty and staff to create meetings. Users who can’t create meetings can still join Meet video meetings created by others.
   2. To provide high-quality video meetings with Hangouts Meet, make sure to set up your network so that Meet can efficiently communicate with the Google infrastructure.

Recommended post-deployment next steps and additional resources

1. Security best practices for administrator accounts: 
   1. Ensure there are multiple G Suite super administrators that are able to login to the G Suite admin console. Note: If your G Suite has less than 500 users or less than 3 super administrators please setup recovery options for super administrator accounts to prevent being locked out.
   2. Protect admin accounts
   3. Manage super admin accounts
   4. Monitor account activity
   5. Prepare for account recovery
2. Vault: Use Vault to retain, hold, search, and export data in support of your organization’s retention and eDiscovery needs.
   1. Get started with Vault and set default retention policies (Note: Vault won’t preserve data until you choose a default retention rule and/or custom retention rule.)
3. Setup and manage the Directory
   1. Set which email addresses show in the Directory
   2. Control who users can find in the Directory
   3. Customize a directory for a team or group
4. (EU organizations only) Register DPO or EU representative for the GDPR
   1. If your organization is required under the European Union’s (EU) Data Protection Regulation (GDPR) to appoint a data protection officer (DPO), an EU representative, or both, register their details in your Google Admin console. 
5. If you need help, there are a number of great resources available:
   1. G Suite Administrator Help Center: Search documentation for managing G Suite users and services.
   2. Google for Education Help Center
   3. G Suite Help forum: Reach out to experts and other administrators in the G Suite community.
   4. Google Classroom Help forum
   5. Google Cloud Connect Community: Join the official community for G Suite and Cloud Identity Premium Edition administrators. See the latest news and resources, including launch announcements, product updates, use cases, and more.
   6. Check out What’s New in G Suite and the G Suite Updates blog
   7. Google for Education Teaching Resources
   8. Google for Education Setup Guides
   9. Google for Education training and PD
   10. Google for Education partner directory 
   11. Google for Education Privacy and Security Center
   12. Explore distance learning resources for schools affected by COVID-19
   13. You can contact G Suite support 24/7 via phone, email, and chat.

Setup 102

Create your account

If needed, you can create a test domain with G Suite for Education, to test features before enabling them in your production G Suite environment. (Note: when you create a test domain, you’ll be creating a new, separate instance of G Suite for Education, with its own admin console.)

Decide on organizational structure

Working with multiple domains

1. If needed, you can add multiple domains or domain aliases to your G Suite for Education environment.
2. Please note the limitations with multiple domains. Also, you can’t directly set different policies or configuration settings for different domains. However, you can place users from each domain into separate organizational units, and then apply different policies to each organizational unit.

Create user accounts, groups, and admin roles

1. There are a few different options for adding users, so choose the best one for your institution. Review options for adding users.
   1. Auto sync accounts for large institutions

1. Automatically provision users, groups, and contacts based on the user data in your LDAP server with G Suite Directory Sync.
2. Use the Admin SDK Directory API to provision a large number of users with data from your existing LDAP directory, such as Microsoft® Active Directory®. This API provides more flexibility than Google Cloud Directory Sync, but requires programming.
3. Partners, as well as third party tools that leverage the Admin SDK (such as GAM) may be available and provide you with additional options for managing your G Suite for Education environment.

1. Find, manage, and add users with existing accounts
   1. If a user has a personal Google Account with the same email address as their managed Google Account, then they have a conflicting account.
   2. You can find and manage conflicting accounts using the Transfer tool for unmanaged users. The tool checks whether any users in your organization have personal Google Accounts that share your organization’s email address.
2. Create groups
   Even if you don’t use groups for mailing lists, groups can be helpful for enabling services and policies, and for sharing Classroom classes and Drive files across the organization. Learn about the different ways to create groups.
3. Set up admin roles
   Grant administrators privileges to share management of G Suite with people you trust.

Password settings and authentication

1. If you already have an identity solution, set up single sign-on with a 3rd party identity provider
2. If you already use Active Directory, sync password data with Active Directory using the G Suite Password Sync tool
3. If you plan on using G Suite as your identity provider, you can set up SSO so your users can access many third-party applications without having to enter their username and password for each application.

Enable and set up other services

1. Groups
   1. Enable Groups
   2. Set Groups sharing permissions
2. Sites
   1. Enable Sites
   2. Set Sites sharing permissions
3. Jamboard
   1. Enable Jamboard
   2. Change Jamboard settings
4. Classroom
   1. Verify teachers and set permissions
   2. Configure class settings
5. Using Gmail and Calendar
   1. Enable Gmail and Calendar.
   2. Configure your domain’s MX records to direct mail flow to Google mail servers.
   3. Set up email routing and delivery.
   4. Review and manage security and compliance settings for Gmail
      • Setup SPF, DKIM, and DMARC
      • Enable advanced phishing and malware protection
      • Setup rules for content compliance
      • Restrict email within an organization
      • Configure an external recipient warning
      • Use OCR to read images
      • Restrict messages to authorized addresses or domains (e.g you might want to allow students to exchange messages with faculty members and other students, but not with people outside of the school)
      • Set up comprehensive mail storage (If your organization uses Vault, we recommend setting up comprehensive mail storage to ensure Vault has full access to your organization’s email messages, including messages sent by Google Calendar, Drive, Docs, Forms, and Keep).
      • Customize spam filter settings
      • Setup email whitelists and blacklists
      • Disable confidential mode and block incoming confidential mode emails

Apply policies to better protect your users and your data

1. Review the security checklists to strengthen the​ ​security and privacy of your information.
2. Set up 2-step verification
3. Whitelist trusted G Suite domains
4. Data loss prevention
   Use data loss prevention (DLP) policies in Drive and Gmail to detect and block sensitive information.

Reporting and Alerts

1. Monitor usage and security with reports
2. Use the alert center to view notifications about potential issues within your domain

Data migration

These migration guides will help you move your organization’s data, such as email, calendar, contacts, folders, files, and permissions, to G Suite.

Additional resources

1. Make learning more effective and engaging with Chromebooks
2. Learn about Accessibility for every student
3. Learn about additional products available to Education
   1. Powering possibilities with Google Cloud Platform
   2. Bringing virtual and augmented reality to every school
   3. Bring learning to life with Jamboard