Compare settings between OUs/find OU-specific settings?

[Ian Crew]

Hi all:

We’ve had a reasonably large (>100K users) Google Apps/G Suite/Workspace instance for about a decade now, and our OU structure has gotten a little bit unmanageable—we’ve got a few big OUs which we understand, but also quite a lot of 1- or 5- or 10-member OUs that have been created over the years for one reason or another (and unfortunately not documented nearly as well as they might have been). 

Before we start getting rid of these mini OUs, it occurred to me that it’d be really helpful to understand how each OU’s settings differ from the root OU. Is that something I might be able to do with GAM, or does anyone know of another method to accomplish this? We’ve got about 70 of these small OUs hanging around, so something automated is key, I think.

Thanks!

Ian

--

Ian Crew Solutions Architect Productivity & Collaboration Services Information Services and Technology

[Ross Scroggs]

Ian,

What settings are you interested in? There is no API support that I know of to get OU settings.

Ross

--

ross.s...@gmail.com

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAD2sLFuz%3Dg_8oPebx0juf8O5mn%2BMejraLq6PeKmiB38zvH5_1A%40mail.gmail.com.

[Ian Crew]

Thanks Ross:

You’ve exactly hit on the issue—I don’t actually know what I’m interested in, as we don’t have good docs about what was changed over the years or why each OU was created. 

For example, I strongly suspect that the /GooglePayments OU exists because Google Payments is turned on for that OU; and the /YAMM OU is for accounts that have access to the third-party Yet Another Mail Merge product. But some of the other OUs are just 3-letter acronyms, so I have no real idea what setting(s) may have been changed from the default over the past 10 years (and several different Workspace administrators). 

But if there isn’t an API to pull the settings for a given OU, we’re out of luck and will need to revert to the old-school “poke around the UI and see what’s different” method….

Cheers,

Ian

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/0FE069CE-AA38-47DA-94D7-7F7E15EB020D%40gmail.com.

[Samuel]

Hello,

I found the request very interesting, indeed according to the OU API, we do not have much information
at best we can know the OUs that do not inherit parameters
gam print orgs allfields

By the way, with standard GAM version 6.15 and 6.17, the command
gam print orgs fields inherit
returns the error: ERROR: 400: Invalid field selection inherit - invalidParameter

Ok with advanced version 6.16.09

This is unfortunately not enough to know the changes by OU but it is a good starting point

[Ian Crew]

Oooh—that report helps a BUNCH, thank you Samuel! In addition to the blockInheritance field, it includes the Description field, which is filled out for more of our orgs than I expected.

I really appreciate the pointer!

Ian

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/7bf9546e-76fc-407b-b2dd-829458b952c2n%40googlegroups.com.

 

Ian Crew Solutions Architect Productivity & Collaboration Services

Berkeley IT

[Rick Davis GLSD]

I realize this is an old thread. Looking to see if anything has changed in the past 3 years. I was recently asked to compare or list the differences in settings applied to two or more student sub-OUs. In the past I have received sales or promotional material from various companies offering to "Audit my Google WorkSpace configuration for safety or security gaps, holes, whatever" and wondered if this means they have tools that they can use to gather this type of information. Or do they have lots of employees with the time to actually look at the various settings and thru screenshots or other methods make comparisons and suggested "Best practice" changes?

Rick

[Ian Crew]

Check out https://github.com/GAM-team/GAM/wiki/Cloud-Identity-Policies, which uses the newer Policy API which is described at https://workspaceupdates.googleblog.com/2025/02/policy-api-general-availability.html

Cheers,

Ian

--

Ian Crew

Architect, Communication and Collaboration Services

Productivity & Collaboration Services
Berkeley IT

University of California, Berkeley

To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/6e9c0b76-1f6c-4258-8680-bb61a4361f45n%40googlegroups.com.