Request: OU-Scoped GAM Access Setup for Multi-Domain Tenant
Bajrang Lal
Hi Team,
We need guidance on restricting GAM access to a specific Organizational Unit (OU), instead of granting access across the entire tenant.
Context: As part of XXX's acquisition engagements, we often work with tenants that have multiple Google Workspace domains under a single tenant. In these cases, we're required to scope GAM access strictly to one designated OU, not the full domain/tenant.
Our understanding is that standard Domain-Wide Delegation (DWD) doesn't support OU-level restriction, and that a Delegated Admin Service Account (DASA) based setup may be the right approach instead.
Could you help us with:
1. Confirming if DASA is the recommended approach for this use case
2. Steps to create a custom admin role scoped to the required OU
3. Linking the service account to this role and configuring GAM to run in DASA mode
4. Any known limitations — which GAM operations/APIs are NOT supported under DASA
Please let us know a good time to connect, or feel free to share documentation/steps directly.
Ross Scroggs
As an existing super admin do:gam create adminrole "Super OU Delegate" privileges all_ougam create admin ouadmin "Super OU Delegate" ou /Test
Now authorize ouadmin:
gam oauth create
gam user ouadmin update service account
Test with desired commands.
Send me a private Meet/Zoom invitation to discuss.
Ross--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/292fbc91-9047-4fd1-9890-8329935e8aedn%40googlegroups.com.