Access service groups to allow application access

Problem

How can you allow certain groups to use restricted Google Workspace services in a specific OU without overriding the OU permissions.

Environment

It is being implemented in a Google Workspace account, where multiple services needs to be denied for the bulk of the users in a specific OU but allowed for a small group of users.

Solution

Using Access groups, we are able to allow a small group of users to access to a restricted service in a specific OU.
  1. Create the list of users and their organizational units.
  2. Choose organizational unit settings for the service.
  3. Create the access group.
  4. Turn on the service.
  5. Check service access.

Cause

When you restrict a service, the whole OU gets affected by it, therefore, access groups allow this to work on only certain users that are members of the group.