SOP — Subscribe to and Manage Google Workspace

Replace the example values (mptwork.com, sample users) with your own. The Admin console setup wizard generates your exact verification token and DNS records — copy those from the wizard; the values below follow Google's standard pattern.

Part 1 — Choose a plan

Google Workspace has four business-facing tiers. Since January 2025, Gemini AI is bundled into every plan (the old standalone Gemini add-ons were retired and base prices rose ~$2). Storage is pooled across the organization, not per user.

• Business tiers (Starter/Standard/Plus) cap at 300 users; Enterprise has no cap.
• Vault (legal hold / eDiscovery) starts at Business Plus — required for regulated/compliance use.
• A 14-day free trial is available; annual commitment saves ~16%.

For mptwork.com this example uses Business Standard (the common SMB sweet spot); step up to Business Plus/Enterprise where Vault, DLP, or advanced endpoint controls are needed.

Part 2 — Subscribe (create the account)

1. Go to https://workspace.google.com → Start free trial.
2. Enter business name, employee count, and region; enter a current contact email.
3. When asked about a domain, choose "Yes, I have one I can use" and enter mptwork.com.
4. Create the first administrator (super admin) sign-in:
   • admin@mptwork.com with a strong password.
5. Complete sign-up; you land in the Admin console (admin.google.com) and the setup wizard.

Part 3 — Verify the domain mptwork.com

1. Return to the wizard and click Verify. (DNS can take up to ~72 hours, but usually minutes.)

In the setup wizard (or Account → Domains → Manage domains), Google provides a TXT verification record. At your DNS host, add:

Part 4 — Set up email DNS (MX, SPF, DKIM, DMARC)

Add these at your DNS host. Remove any leftover MX records from a previous provider, or mail delivery will be intermittent.

Notes:

• MX: one record, smtp.google.com at priority 1 (since April 2023). The legacy 5-record ASPMX set still works but isn't needed for new setups.
• SPF: publish only one SPF record — if one already exists, merge the include: into it (don't add a second).
• DKIM: in the Admin console go to Apps → Google Workspace → Gmail → Authenticate email, Generate new record (2048-bit, selector google), publish the provided TXT at google._domainkey, then click Start authentication.
• After MX is in place, complete Activate Gmail in the wizard.

Part 5 — Organizational structure, admins, and security foundation

1. Organizational units (OUs): Directory → Org units. Build a tree to scope policies, e.g. /MPT Work → /MPT Work/Staff, /MPT Work/Contractors, /MPT Work/Devices.
2. Super admins and roles: keep super admins to a minimum; assign pre-built or custom admin roles (Help Desk, Groups, User Management) for least privilege under Account → Admin roles.
3. Break-glass admin: create a second super admin (e.g. superadmin-bg@mptwork.com) with a long unique password stored offline, excluded from any enforced SSO so it always works.
4. 2-Step Verification (2SV): Security → Authentication → 2-step verification — turn on and plan enforcement (Part 8). Require security keys/passkeys for admins.

Part 6 — Users, groups, and licenses

1. Create users: Directory → Users → Add new user (e.g. Jane Smith, jsmith@mptwork.com), placed in the right OU. For bulk, use Bulk upload (CSV).
2. Sync from AD (optional): for hybrid identity, use Google Cloud Directory Sync (GCDS) or Directory Sync to provision users/groups from on-prem AD/LDAP.
3. Groups: Directory → Groups → create distribution/collaboration groups and aliases, e.g. all-staff@mptwork.com, info@mptwork.com.
4. Licenses: Billing → assign the Business Standard license automatically or per-OU; reconcile active vs licensed seats regularly.

Joiner / mover / leaver (JML):

Part 7 — Configure core services

1. Gmail (Apps → Google Workspace → Gmail): confirm routing, configure spam/compliance and any routing/split-delivery; verify SPF/DKIM/DMARC pass.
2. Drive & Docs (Apps → Drive and Docs): set external sharing to the least-permissive level needed; configure shared drives and link-sharing defaults.
3. Meet / Calendar / Chat: set org-wide meeting, external-sharing, and chat/external-chat policies consistent with the Drive posture; set calendar sharing defaults.
4. Apply service settings per OU so policies differ for Staff vs Contractors as needed.

Part 8 — Security baseline

1. Enforce 2-Step Verification (Security → 2SV) for all users after an enrollment grace period; require phishing-resistant passkeys/security keys for admins.
2. Context-Aware Access (Business Plus / Enterprise): grant access based on user, device, and location conditions.
3. Endpoint/mobile management (Devices): enable basic mobile management for all; use advanced management (Business Plus/Enterprise) to enforce screen lock, encryption, and remote wipe.
4. Alert center & Security dashboard: monitor login, phishing, and data-exfiltration alerts; review the Security health recommendations.
5. Google Vault (Business Plus+): set retention rules and legal holds for Gmail, Drive, and Chat where compliance requires.
6. Backup: Workspace retains data but a separate third-party backup (e.g. Spanning, Druva, Afi) is recommended for point-in-time recovery of Gmail/Drive.

Part 9 — Single sign-on (identity)

Google Workspace can be the identity provider for other SaaS apps, or consume an external IdP.

1. Google as IdP (SAML/OIDC): Apps → Web and mobile apps → Add app → Add custom SAML app (or pick a pre-integrated app). Provide the app's ACS URL and Entity ID, map attributes, download Google's IdP metadata/certificate, and assign access by OU/group. Users launch apps from the app launcher.
2. External IdP / federation: Security → Authentication → SSO with third-party IdP if another provider (e.g. Entra ID) is your primary IdP.
3. Directory provisioning: use auto-provisioning for supported SAML apps so accounts are created/suspended automatically.

Part 10 — Ongoing management

Admin destinations

Appendix — Complete DNS record set for mptwork.com

Notes and caveats

• Copy the exact verification token and DKIM value from your Admin console — they are unique to your domain.
• Gemini AI is bundled in all plans (since Jan 2025); Business tiers cap at 300 users; Vault starts at Business Plus.
• Standard accounts cap sending at ~2,000 emails/user/day.
• Verify current details at workspace.google.com and the Admin console — Google changes plans, pricing, and console layout periodically.