This article is for IT administrators who have limited time to provision 50,000+ user accounts.
For quick, large-scale account provisioning, you can use third-party solutions. For example, the free, downloadable, open-source Google Apps Manager (GAM) uses the Admin SDK Directory API to create and manage Google Workspace users and groups.
GAM interacts with many Google APIs, which you can use to also manage other account features and resources. For more information about integrations with third parties, visit the tutorials page at Solve with Google Cloud.
Before you begin
Provisioning accounts on a large scale requires:
- Facility with command-line prompts
- A paid Google Workspace account that is:
- No longer in a free trial. Learn more
- Domain-verified. Learn more
Step 1: Avoid account conflicts
Some of your users might have a personal Google Account, such as a Gmail address, which could generate conflicts when you provision their new, managed Google Workspace or Cloud Identity account. To avoid such issues:
- Read About conflicting accounts.
- Learn how to Find and manage existing accounts.
Step 2: Create a simple, flat organizational structure
Avoid creating a complex organizational unit hierarchy with many levels. You can modify the hierarchy and move users later. Here are some tips on setting up a simplified organizational structure:
- Focus on the services and features the users you manage need to access.
- Restrict service and feature availability at the top-level organizational unit, granting access to child organizational units.
Read more about How the organizational structure works.
Education example
In the table below, the structure on the left shows the actual structure of the organization. Initially, this structure might be difficult to manage, for example, if you must repeatedly grant teachers access to advanced Google Meet features for numerous organizational units in the school.
The proposed structure focuses on functionality. As an admin, you can easily turn off services and features for all students in the /Students organizational unit. For example, you might turn off self-service password recovery and apply YouTube restrictions. You might also enable advanced functionality for teachers and other staff members, such as Meet streaming and recording and 2-Step Verification.
| Example organizational structure | Recommended organizational structure |
|---|---|
|
|
|
Large organization example
First, determine what services and features your users need. Then:
- Apply these settings at the top-level organizational unit.
Unless you override those settings, child organizational units will inherit them. Examples: - For added security, require departments to use 2-Step Verification.
| Example organizational structure | Recommended organizational structure |
|---|---|
|
|
|
Step 3: Prepare a data source
Create a comma-separated value (CSV) file with the necessary data to proceed with user account creation. Required fields:
- FirstName
- LastName
- PrimaryEmail—The email the user will sign in with
- Password—Must be at least 8 characters
- OrgUnit—To create users in their respective organizational units, taking into account the recommendations above
Note: Enter a
/(forward slash) to place users in your top-level (root) organizational unit. Separate child organizational units with a forward slash—for example/Staff/Teachers.
Education example
FirstName,LastName,PrimaryEmail,Password,OrgUnit
Jane,Doe,[email protected],Zee+HWdt,/Students
John,Smith,[email protected],X2Ae+pME,/Staff
Large organization example
FirstName,LastName,PrimaryEmail,Password,OrgUnit
Jane,Doe,[email protected],V8hmj/QE,/
John,Smith,[email protected],9/t0UHQ6,/Sales
Step 4: Set up GAM
If you decide to GAM, follow these recommended steps:
- With GAM version 5.10 and above, before executing GAM for the first time, create a file named noshorturls.txt in the same folder as GAM.
This turns off gam-shortn.appspot.com short URLs. - From the GAM website, download GAM.
- Configure the tool.
- During setup, when asked if you’re “ready to authorize GAM to manage Google Workspace user data and settings,” answer N (no) to skip Domain-Wide Delegation.
This command helps you confirm that GAM is associated with the right Google Workspace account:
gam info domain
Step 5: Create multiple users with GAM
To create the users, GAM reads from a comma-separated value (CSV) file and issues the relevant requests to the Admin SDK Directory API.
If you created a comma-separated value (CSV) file with the fields specified in Step 3 above, this command creates the users in the CSV:
gam csv users.csv gam create user ~PrimaryEmail firstname ~FirstName lastname ~LastName password ~Password org ~OrgUnit changepassword on
Make sure to:
- Create a unique password for each user.
- Use the optional parameter
changepassword onto force the user to change their password after their first sign-in.
Alternative: What if your data source is missing some fields?
If your data source only has the first and last names and one password for each user, you can create usernames in the format [email protected]. For a user named Charlie Smith, use [email protected].
The command is:
gam csv users.csv gam create user [email protected] password ~Password changepassword on
This approach assumes that no users have:
- The same name
- First and last names with:
- Spaces
- Other disallowed characters
Go to the Name guidelines for users and groups.
Questions
Go to Contact Google Workspace support.
If you have questions about the content of this article, include that information in the support case and link the article. To share logs or other details that could help us assist you, contact us by sending an email.
For details about the Google Workspace for Education process, go to:
- Get started with Google Workspace for Education
- Google Workspace for Education FAQ
After creating your Google Workspace account, you’re prompted to verify ownership of your domain. If you don’t remember doing so, sign in to your Admin console, go to the domains section, and click Manage domains.
The first domain listed is your primary domain. The status column shows whether or not the domain requires verification.
Google Cloud Support doesn’t support these or other third-party solutions, only the Admin SDK Directory API those tools use. Although we can’t help with the GAM tool itself, we can help if the underlying APIs return errors, specifically Admin SDK Directory API. Learn more GAM commands and techniques at the GAM Wiki.
Need help with GAM? Reach out to a community of Google Workspace admins willing to offer support, at the GAM discussion group.
If you think there's an issue with the Admin SDK Directory API, provide Google Cloud Support these details:
- The HTTP method and endpoint that the third-party solution is calling (for example,
POST /admin/directory/v1/users?fields=primaryEmail) -
Response code and message (for example, 403: Not Authorized to access this resource/api - forbidden)
- Response HTTP header date (for example, Date: Wed, 22 Jun 2020 17:48:48 GMT)
- Entity making the call: username, service account, or Google Cloud project ID
Remove information such as names, passwords, authentication request headers, IP addresses, values of custom schemas, or any other information you deem sensitive.
The default quotas should be sufficient for most customers. For additional information about API limits, go to Directory API: Limits and Quotas.
If you still want more quota for your project, consult the requirements in the quota section of the Google Cloud console:
- Open the Google Cloud console.
- Select the project GAM created at the top.
- On the left, click Navigation menu
> IAM & Admin > Quotas.
- Under Service, filter by Admin SDK (relevant for user provisioning).
- Select the items you wish to request more quota for.
- At the top, click Edit Quotas.
To enable billing on the Google Cloud project created by GAM, go to How do I enable billing on my current project(s).
