Use the Google Workspace Admin console to create individual user accounts, give administrators only the privileges they need, manage Gmail settings, and connect your domain for custom email. The key distinction is that an email alias is another address for an existing user—not a separate account or private inbox.
What to prepare before using the Admin console
For a domain-verified organization, people need individual user accounts to use the organization’s Google services. Sign in with an administrator account that has the required privilege for the task. A user-management privilege is needed to add accounts; Gmail settings require a Gmail Settings administrator privilege. If a control is missing, check the account’s role and privileges before assuming the feature is unavailable.
![Google Workspace Guide: Unlock Every Google App – Elevate Efficiency with Exclusive Tips, Time-Savers & Step-by-Step Screenshots for Quick Mastery [II EDITION]](https://m.media-amazon.com/images/I/41CX0AjJhAL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
Google’s help page describes adding users individually and points administrators managing many accounts to a bulk-add option. License requirements and edition limits can vary, so check current documentation for your Workspace edition before planning a rollout.
How to add a user account
- In the Admin console, go to Directory > Users and select Add new user.
- Enter the person’s name and primary email address. If your organization has multiple domains, select the appropriate domain. You can also enter a secondary email address and phone number; organizational unit, password, and profile photo can be handled during setup.
- Provide the account details to the user through an appropriate secure channel. Google supports previewing and emailing account details to a secondary address. The password-reset link in its welcome email expires after 48 hours.
- Allow time for the account to become available: Google says service access and directory search visibility can take up to 24 hours.
See Google’s instructions for adding an account for a new user. Avoid giving several people one shared account: individual accounts make access and account management person-specific.
How to delegate admin work safely
Administrator roles determine which Admin console tasks a person can perform. Depending on assigned privileges, an administrator may be able to create, read, update, suspend, rename, or delete accounts; reset passwords; or manage aliases. Assign only the access required for each person’s duties, and reserve broad, account-wide powers for trusted administrators. Review Google’s administrator privilege definitions and guidance on making a user an admin when setting roles; available labels and controls may change.
How to secure administrator and user accounts
Require 2-Step Verification (2SV), especially for administrators and people handling sensitive information. Google identifies security keys as its strongest 2SV method and says they protect against phishing. Its 2SV guidance also lists Google prompts, phone text or voice codes, and passkeys. The right option depends on account eligibility, device support, and how much friction your users can manage.
| Method | Phishing resistance and trade-offs | What users need |
|---|---|---|
| Security key | Google calls this the strongest method and says it protects against phishing. A key can be inconvenient if users do not have it when signing in. | A physical key; connection may be USB, Bluetooth, or NFC depending on the key. |
| Google prompt | Requires the user to approve a sign-in prompt on a phone rather than enter a code. | A phone that can receive and approve the prompt. |
| Text or voice code | Available in many cases, but Google discourages SMS because carrier networks may be intercepted. | Access to the phone number receiving the code or call. |
| Passkey | Can use a device’s screen lock or another supported authenticator; availability depends on domain eligibility and account settings. | A phone, security key, or computer with a supported screen-lock method, and the relevant admin setting enabled. |
Google Workspace Admin Help says 2SV “is the first line of defense that can cut account takeover by as much as 50%.” The page does not identify the underlying study or its publication year, so treat the figure as Google’s statement rather than a result from a named independent study. Read Google’s 2-Step Verification guidance for setup and method details.
How to manage Gmail settings
Organization-level Gmail controls are under Apps > Google Workspace > Gmail > User settings. End-user access controls are in Gmail’s End User Access section. Apply a setting at the top-level organization, a child organizational unit, or a configuration group depending on who should receive it. Google says changes can take up to 24 hours to take effect, and some options vary by edition. Follow its Gmail settings instructions and confirm the setting’s scope before rollout.
How custom-domain email works
To use Gmail with an address at your organization’s domain, the organization must own and verify that domain, then configure Gmail by updating the domain’s MX records. The exact DNS steps depend on the domain host’s interface, so use Google’s current setup instructions and contact the host if you need help with its DNS controls. Google also recommends considering SPF and DKIM to help prevent email spoofing; follow the current guidance for your domain and DNS provider rather than copying record values from an unrelated setup.
Google’s guidance on alternate email addresses and aliases explains aliases, but MX setup is a separate domain configuration task. Confirm ownership, verification, and mail routing before switching users to the custom address.
Alias or separate user: which should you create?
| Need | Use | What it means |
|---|---|---|
| Another address for the same person, such as a role-based address | Email alias | An alternate address attached to a user’s account. It can send and receive mail for that user, but it is not a separate inbox or private identity and may be visible in directory or search contexts. |
| A distinct account for another person | Separate user account | An individual managed account with its own sign-in and account access. Do not substitute a shared login for individual users. |
Using Outlook, Apple Mail, or another mail client
Check that the current version of a third-party client supports OAuth. Google says Workspace accounts stopped supporting less-secure-app access that asks for a Google username and password on May 1, 2025; OAuth is required for third-party apps and devices. An administrator can enable IMAP for compatible clients. Consult Google’s third-party email client setup guidance and the client’s current sign-in documentation before deployment.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What to do if an account may be compromised
- Temporarily suspend the account to prevent unauthorized access. Google says suspension resets sign-in cookies and OAuth tokens.
- Investigate account activity and work with the user to review recovery information.
- Restore the account only after the issue has been addressed.
Use Google’s guidance for identifying and securing compromised accounts to inform the response.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
