Replace the example values (mptwork.com, sample users) with your own. The Admin console setup wizard generates your exact verification token and DNS records — copy those from the wizard; the values below follow Google's standard pattern.
Part 1 — Choose a plan
Google Workspace has four business-facing tiers. Since January 2025, Gemini AI is bundled into every plan (the old standalone Gemini add-ons were retired and base prices rose ~$2). Storage is pooled across the organization, not per user.
Plan
Price (annual / flexible, per user/mo)
Storage (pooled)
Meet
Notable
Business Starter
$7 / $8.40
30 GB
100
Custom-domain email, core apps
Business Standard
$14 / $16.80
2 TB
150
Meeting recording, shared drives
Business Plus
$22 / $26.40
5 TB
500
Google Vault (retention/eDiscovery), advanced endpoint mgmt, enhanced security
Enterprise
Custom quote
5 TB+
1,000
DLP, S/MIME, data regions, advanced security/controls
Business tiers (Starter/Standard/Plus) cap at 300 users; Enterprise has no cap.
Vault (legal hold / eDiscovery) starts at Business Plus — required for regulated/compliance use.
A 14-day free trial is available; annual commitment saves ~16%.
For mptwork.com this example uses Business Standard (the common SMB sweet spot); step up to Business Plus/Enterprise where Vault, DLP, or advanced endpoint controls are needed.
Part 2 — Subscribe (create the account)
Go to https://workspace.google.com → Start free trial.
Enter business name, employee count, and region; enter a current contact email.
When asked about a domain, choose "Yes, I have one I can use" and enter mptwork.com.
Create the first administrator (super admin) sign-in:
admin@mptwork.com with a strong password.
Complete sign-up; you land in the Admin console (admin.google.com) and the setup wizard.
Part 3 — Verify the domain mptwork.com
Return to the wizard and click Verify. (DNS can take up to ~72 hours, but usually minutes.)
In the setup wizard (or Account → Domains → Manage domains), Google provides a TXT verification record. At your DNS host, add:
Type
Host
Value
TXT
@
google-site-verification=XXXXXXXX (copy the exact token)
Part 4 — Set up email DNS (MX, SPF, DKIM, DMARC)
Add these at your DNS host. Remove any leftover MX records from a previous provider, or mail delivery will be intermittent.
MX: one record, smtp.google.com at priority 1 (since April 2023). The legacy 5-record ASPMX set still works but isn't needed for new setups.
SPF: publish only one SPF record — if one already exists, merge the include: into it (don't add a second).
DKIM: in the Admin console go to Apps → Google Workspace → Gmail → Authenticate email, Generate new record (2048-bit, selector google), publish the provided TXT at google._domainkey, then click Start authentication.
After MX is in place, complete Activate Gmail in the wizard.
Part 5 — Organizational structure, admins, and security foundation
Organizational units (OUs): Directory → Org units. Build a tree to scope policies, e.g. /MPT Work → /MPT Work/Staff, /MPT Work/Contractors, /MPT Work/Devices.
Super admins and roles: keep super admins to a minimum; assign pre-built or custom admin roles (Help Desk, Groups, User Management) for least privilege under Account → Admin roles.
Break-glass admin: create a second super admin (e.g. superadmin-bg@mptwork.com) with a long unique password stored offline, excluded from any enforced SSO so it always works.
2-Step Verification (2SV): Security → Authentication → 2-step verification — turn on and plan enforcement (Part 8). Require security keys/passkeys for admins.
Part 6 — Users, groups, and licenses
Create users: Directory → Users → Add new user (e.g. Jane Smith, jsmith@mptwork.com), placed in the right OU. For bulk, use Bulk upload (CSV).
Sync from AD (optional): for hybrid identity, use Google Cloud Directory Sync (GCDS) or Directory Sync to provision users/groups from on-prem AD/LDAP.
Groups: Directory → Groups → create distribution/collaboration groups and aliases, e.g. all-staff@mptwork.com, info@mptwork.com.
Licenses: Billing → assign the Business Standard license automatically or per-OU; reconcile active vs licensed seats regularly.
Joiner / mover / leaver (JML):
Event
Steps
Joiner
Create name@mptwork.com, place in OU, add to groups, send 2SV enrollment guidance
Mover
Move to the new OU / update group membership so policies and access follow
Leaver
Suspend the account, transfer Drive/email ownership (Data transfer tool), reset/sign-out sessions, then delete or archive after a grace period
Part 7 — Configure core services
Gmail (Apps → Google Workspace → Gmail): confirm routing, configure spam/compliance and any routing/split-delivery; verify SPF/DKIM/DMARC pass.
Drive & Docs (Apps → Drive and Docs): set external sharing to the least-permissive level needed; configure shared drives and link-sharing defaults.
Meet / Calendar / Chat: set org-wide meeting, external-sharing, and chat/external-chat policies consistent with the Drive posture; set calendar sharing defaults.
Apply service settings per OU so policies differ for Staff vs Contractors as needed.
Part 8 — Security baseline
Enforce 2-Step Verification (Security → 2SV) for all users after an enrollment grace period; require phishing-resistant passkeys/security keys for admins.
Context-Aware Access (Business Plus / Enterprise): grant access based on user, device, and location conditions.
Endpoint/mobile management (Devices): enable basic mobile management for all; use advanced management (Business Plus/Enterprise) to enforce screen lock, encryption, and remote wipe.
Alert center & Security dashboard: monitor login, phishing, and data-exfiltration alerts; review the Security health recommendations.
Google Vault (Business Plus+): set retention rules and legal holds for Gmail, Drive, and Chat where compliance requires.
Backup: Workspace retains data but a separate third-party backup (e.g. Spanning, Druva, Afi) is recommended for point-in-time recovery of Gmail/Drive.
Part 9 — Single sign-on (identity)
Google Workspace can be the identity provider for other SaaS apps, or consume an external IdP.
Google as IdP (SAML/OIDC): Apps → Web and mobile apps → Add app → Add custom SAML app (or pick a pre-integrated app). Provide the app's ACS URL and Entity ID, map attributes, download Google's IdP metadata/certificate, and assign access by OU/group. Users launch apps from the app launcher.
External IdP / federation: Security → Authentication → SSO with third-party IdP if another provider (e.g. Entra ID) is your primary IdP.
Directory provisioning: use auto-provisioning for supported SAML apps so accounts are created/suspended automatically.
Part 10 — Ongoing management
Cadence
Activity
Daily / as needed
Alert center; suspicious-login and phishing alerts; help-desk (resets, access)
