This chapter covers Google Workspace, Google's integrated suite of cloud-native productivity and collaboration tools. For the GCDL exam, understanding Google Workspace is critical because it represents a core pillar of Google Cloud's end-user computing strategy, and questions often appear in the context of digital transformation, security, and collaboration. Expect approximately 8-12% of exam questions to touch on Workspace concepts, including its architecture, key applications, security features, and integration with other Google Cloud services. This chapter provides the depth needed to answer those questions accurately.
Jump to a section
Think of Google Workspace as a fully managed office building for your organization. The building has a main entrance (Google Admin Console) where the building manager (IT admin) controls who gets keycards (user accounts), which floors they can access (apps like Gmail, Drive, Meet), and what security rules apply (2-step verification, session length). Each employee gets a personalized office (account) with a desk (Gmail), filing cabinets (Drive), a conference room (Meet), and a whiteboard (Docs/Sheets/Slides). The building has shared spaces: a lobby (Google Chat) for quick conversations, a mailroom (Gmail routing) that sorts incoming letters (emails) and can reject spam or dangerous packages (phishing protection). The building manager can set up shared team rooms (Shared Drives) where files belong to the team, not individuals, so when someone leaves, the files stay. All rooms are connected by a high-speed internal network (Google's infrastructure) that automatically syncs changes everywhere instantly. The building also has a security desk (Vault) that keeps logs of who entered which room and when, for compliance. If the building manager wants to let a contractor (external user) into just one floor (a specific Drive folder), they can issue a temporary guest pass (sharing with expiration). The entire building is managed by Google, so no one needs to install plumbing or wiring (server maintenance) – they just use the space. The key insight: Google Workspace is not just a set of apps; it's a unified, policy-driven environment where identity, security, collaboration, and compliance are baked into the infrastructure, exactly like a smart office building.
What is Google Workspace and Why Does It Exist?
Google Workspace (formerly G Suite) is a cloud-native productivity suite that includes Gmail, Google Drive, Docs, Sheets, Slides, Meet, Chat, Calendar, Sites, and more. Unlike traditional on-premises suites like Microsoft Office, Workspace is built entirely for the cloud, meaning no local installation, automatic updates, and real-time collaboration. For the GCDL exam, Workspace is presented as a key enabler of digital transformation: it allows organizations to move from siloed, on-premises tools to a unified, secure, and mobile-friendly environment.
The exam focuses on three main pillars of Workspace: (1) Identity and Security – how Workspace integrates with Google Cloud Identity and provides advanced security controls, (2) Collaboration and Productivity – how real-time co-authoring, shared drives, and communication tools enhance teamwork, and (3) Compliance and Data Governance – how Vault, DLP, and retention policies help meet regulatory requirements.
How Google Workspace Works Internally
Under the hood, Google Workspace runs on Google's global infrastructure, which includes data centers, edge caching, and a private fiber network. Every user action – sending an email, editing a document, joining a Meet call – is processed by Google's backend services, which are replicated across multiple regions for redundancy and low latency. For example, when you edit a Google Doc, the changes are sent via WebSocket to Google's servers, which then propagate the change to all other collaborators in near real-time using Operational Transformation (OT) algorithms. This is fundamentally different from traditional file-sharing where users download, edit, and upload.
From an admin perspective, Workspace is managed through the Google Admin Console (admin.google.com). Here, admins configure user accounts, set up organizational units (OUs) to apply different policies, enable or disable services, manage security settings (like 2-Step Verification), and view audit logs. The Admin Console also integrates with Google Cloud Directory Sync (GCDS) to synchronize users and groups from an existing LDAP or Active Directory, and with Cloud Identity for identity federation.
Key Components and Defaults
Gmail: Default storage is 30 GB per user (shared with Drive and Photos). For Google Workspace Enterprise editions, storage is unlimited (though practical limits apply for very large organizations). Gmail supports custom email domains (e.g., @yourcompany.com) and includes built-in spam and phishing protection using machine learning.
Google Drive: Stores files, docs, and shared drives. Each user has 30 GB (Business Starter) or unlimited (Business Standard, Plus, Enterprise). Files can be shared with individuals, groups, or publicly. Shared Drives (formerly Team Drives) are owned by the organization, not an individual, so files remain when a user leaves.
Google Docs, Sheets, Slides: Cloud-native editors that support real-time collaboration. Version history is kept for 30 days (or 100 revisions) for free accounts, but Workspace editions can extend this via Vault. Templates are available for common formats.
Google Meet: Video conferencing with up to 100 participants (Business Starter) or 250 (Enterprise). Supports live captions, screen sharing, and breakout rooms. Meet integrates with Calendar for scheduling.
Google Chat: Team messaging with direct messages and rooms. Spaces (formerly Rooms) are persistent chat rooms that can be organized by topic. Chat integrates with Drive, Docs, and Calendar.
Google Calendar: Shared calendars, appointment scheduling, and resource booking (rooms, equipment). Supports multiple time zones and visibility settings.
Google Sites: Simple website builder for intranets or project sites, integrates with Drive and Docs.
Google Vault: Archiving and eDiscovery tool for Gmail, Drive, Chat, and Meet recordings. Admins can set retention rules, hold data for legal cases, and export data.
Google Cloud Search: Unified search across Gmail, Drive, Docs, and other Workspace data, using AI to surface relevant results.
Configuration and Verification
Admins configure Workspace via the Admin Console. Key tasks include: - Adding users: Manually or via bulk CSV upload, or sync with GCDS. - Setting up organizational units: Create OUs (e.g., Sales, Engineering) to apply different policies. For example, you can allow external file sharing for Marketing but disable it for Finance. - Enabling 2-Step Verification: Under Security > Basic settings. Can be enforced for all users or specific OUs. - Configuring email routing: Set up SMTP relay, content compliance (e.g., add footer), and recipient address maps. - Creating shared drives: Under Apps > Google Workspace > Drive and Docs > Manage Shared Drives. - Setting up Vault: Under Apps > Google Workspace > Vault, configure retention rules for each service.
To verify settings, admins can use the Reports section in Admin Console to view audit logs (e.g., login events, file sharing, admin actions). For advanced monitoring, Google Workspace Audit in Cloud Logging can stream logs to Cloud Logging for analysis.
Integration with Google Cloud
Workspace integrates with other Google Cloud services: - Cloud Identity: Provides identity management for Workspace and GCP. Workspace users can access GCP resources using the same credentials. - Cloud Search: Extends search to third-party data sources via connectors. - AppSheet: No-code app development platform that can use Workspace data (e.g., Drive sheets) as data sources. - Apigee: API management for custom integrations with Workspace APIs. - BigQuery: Analyze Workspace audit logs by exporting them to BigQuery.
The exam often tests the relationship between Workspace and Cloud Identity: Workspace uses Cloud Identity for user management, and Cloud Identity can be used standalone (without Workspace) for GCP-only organizations.
User Provisioning and Authentication
When a new employee joins, the admin creates a user account in the Admin Console (or via GCDS sync). The user receives a welcome email with a temporary password. On first login, they are prompted to set a new password and optionally enroll in 2-Step Verification. The authentication request goes to Google's identity servers, which check against Cloud Identity. If federation is set up (e.g., with Okta or ADFS), the request is redirected to the external IdP. Once authenticated, the user gets a session cookie with a default session duration (e.g., 24 hours for web apps, configurable). The user is then authorized based on their OU policies and service access settings.
Email Flow in Gmail
When an email is sent from an external sender to user@company.com, the MX record for company.com points to Google's mail servers. Google's spam filter (using machine learning) checks the email for spam, phishing, and malware. If it passes, the email is delivered to the user's inbox. The admin can configure content compliance rules (e.g., add disclaimer, block attachments with macros). If the user is in an OU with retention rules, the email is also archived in Vault. For outbound email, Google's servers use SPF, DKIM, and DMARC to authenticate the email, reducing the chance of it being marked as spam by recipients.
Real-Time Collaboration on a Document
User A creates a Google Doc and shares it with User B (edit access). Both users open the doc simultaneously. The document is stored as a set of operations in Google's cloud, not as a traditional file. When User A types a character, a WebSocket connection sends the operation to Google's server, which applies it using Operational Transformation (OT) and sends the change to User B's browser. OT ensures that concurrent edits converge to the same final state without conflicts. Users see each other's cursors and changes in near real-time (typically under 200ms). Version history is saved every 10 seconds or on significant changes, and users can revert to any previous version within the retention period.
Shared Drive File Management
An admin creates a Shared Drive for a project team. The Shared Drive has its own storage quota (unlimited in Enterprise editions). The admin adds members with roles: Manager (full control), Content Manager (edit, but not manage permissions), Contributor (edit own files), Commenter, or Viewer. When a team member uploads a file, it belongs to the Shared Drive, not the user. If the user leaves the organization, the file remains. Files can be moved between Shared Drives (within the same organization) by managers. Shared Drives have their own sharing settings: admins can restrict external sharing at the OU or Shared Drive level.
Vault Retention and eDiscovery
An admin sets a retention policy for Gmail messages to retain all messages for 7 years. When a user deletes an email, it is moved to Trash, but the retention policy keeps a copy in Vault. After 30 days, the email is permanently deleted from the user's mailbox, but the Vault copy remains. For eDiscovery, a legal team member (with Vault privileges) can create a case, search for specific terms or custodians, and place a hold on relevant data. While on hold, data cannot be deleted even if retention expires. The legal team can export the data for review. Vault also supports auditing of admin actions.
Enterprise Deployment Scenarios
Scenario 1: Large Enterprise Migrating from On-Premises Exchange to Google Workspace
A multinational corporation with 10,000 employees decides to migrate from on-premises Microsoft Exchange and file servers to Google Workspace. The IT team uses Google Workspace Migrate (formerly G Suite Migrate) to transfer emails, calendars, and contacts from Exchange to Gmail. They also use Google Drive File Stream (now Drive for Desktop) to migrate file shares. Challenges include: (1) DNS cutover – changing MX records to point to Google requires careful timing to avoid email loss; (2) User training – employees must adapt to a new interface and collaboration model; (3) Compliance – the company must set up Vault retention policies to meet industry regulations (e.g., SEC, HIPAA). After migration, the company benefits from reduced IT overhead (no more Exchange servers) and improved collaboration (real-time co-authoring, video meetings). However, they must monitor for shadow IT (users using unsanctioned apps) and enforce data loss prevention (DLP) rules to prevent sensitive data leakage.
Scenario 2: Small Business Using Workspace for Remote Collaboration
A startup with 50 employees adopts Google Workspace Business Standard. They use Gmail for company email, Google Drive for file storage, and Google Meet for daily stand-ups. The admin sets up organizational units for Engineering and Sales, with different sharing policies: Engineering can share files externally with specific domains, while Sales can share with anyone but with expiration dates. They use Google Chat for team communication and integrate with third-party tools like Trello via Google Chat bots. The company also uses AppSheet to create a custom inventory management app that reads from a Google Sheet. Common issues: users accidentally sharing sensitive files publicly, which the admin can mitigate by setting default sharing to 'Anyone with the link can view' (restricted) and enabling DLP rules to block sharing of credit card numbers.
Scenario 3: Education Institution Using Google Workspace for Education
A university with 20,000 students and 5,000 staff uses Google Workspace for Education Fundamentals (free). They leverage Classroom for assignment management, Drive for storage, and Meet for virtual lectures. The IT team enables security features like 2-Step Verification for staff (not students) and sets up Vault to retain student emails for 1 year per policy. They use Google Cloud Search to allow students to find course materials across Drive and Sites. A challenge is managing shared drives for research groups – they must ensure that only authorized members can access sensitive research data. They use Cloud Identity groups to manage access. When a student graduates, their account is disabled, but data is retained per policy.
What the GCDL Exam Tests on Google Workspace
The GCDL exam objective 4.1 focuses on understanding Google Workspace as a productivity suite and its role in digital transformation. Specifically, you should know:
The core applications (Gmail, Drive, Docs, Sheets, Slides, Meet, Chat, Calendar) and their primary use cases.
How Workspace integrates with Cloud Identity for user management and single sign-on.
Key security features: 2-Step Verification, OAuth, security keys, DLP, and phishing protection.
Compliance features: Vault for archiving and eDiscovery, retention policies, and legal holds.
The difference between Shared Drives and My Drive (ownership model).
Licensing editions: Business Starter, Business Standard, Business Plus, Enterprise Essentials, Enterprise Standard, Enterprise Plus. Know the key feature differences (e.g., storage limits, meeting size, Vault availability).
Integration with other Google Cloud services: Cloud Search, AppSheet, BigQuery (audit logs).
Common Wrong Answers and Why Candidates Choose Them
'Workspace requires a local server for email routing.' – Wrong. Workspace is fully cloud-based; email is routed through Google's servers. Candidates might think of hybrid deployments, but Workspace does not require on-premises infrastructure.
'Google Drive files are stored on the user's device.' – Wrong. Files are stored in the cloud, though they can be cached locally via Drive for Desktop. Candidates confuse caching with storage.
'Shared Drives are owned by the user who creates them.' – Wrong. Shared Drives are owned by the organization. Candidates might think of personal drives.
'Vault is only for Gmail.' – Wrong. Vault supports Gmail, Drive, Chat, and Meet recordings. Candidates may underestimate its scope.
'All Workspace editions include unlimited storage.' – Wrong. Only Business Standard and above offer unlimited storage (with some limits). Business Starter has 30 GB per user.
Specific Numbers and Terms That Appear on the Exam
30 GB per user for Business Starter
100 participants in Meet for Business Starter, 250 for Enterprise
2-Step Verification can be enforced at the OU level
Shared Drives are available in all editions (but storage limits apply)
Vault is available in Business Plus and Enterprise editions (not Starter or Standard)
Google Cloud Directory Sync (GCDS) is used for syncing from Active Directory
Edge Cases and Exceptions
Data regions: For compliance, Enterprise customers can set data region policies (e.g., store data only in the US).
App access: Admins can restrict access to Workspace apps based on device type (e.g., allow only managed iOS devices).
S/MIME: Available for Enterprise editions to encrypt emails.
External sharing: Can be restricted to allow only specific domains or to require expiration dates.
How to Eliminate Wrong Answers
If an answer mentions 'on-premises' or 'local server' for Workspace, it's likely wrong.
If an answer says 'files are stored on device' or 'requires installation,' it's wrong.
For questions about data ownership in Shared Drives, the key is 'organization owns the data'.
For Vault, look for the scope: Gmail, Drive, Chat, Meet – not just one service.
Google Workspace is a cloud-native productivity suite with no on-premises components.
Key apps: Gmail, Drive, Docs, Sheets, Slides, Meet, Chat, Calendar.
Shared Drives are organization-owned; My Drive is user-owned.
Vault provides archiving and eDiscovery for Gmail, Drive, Chat, and Meet.
2-Step Verification can be enforced at the OU level for security.
Business Starter has 30 GB storage per user; Business Standard and above have unlimited.
Workspace integrates with Cloud Identity for user management and SSO.
GCDL exam covers Workspace as a digital transformation tool, focusing on security, collaboration, and compliance.
These come up on the exam all the time. Here's how to tell them apart.
Google Workspace
Cloud-native, no on-premises server required
Real-time collaboration built into Docs/Sheets/Slides
Unified admin console (Google Admin Console)
Integrated with Google Cloud Platform services
AI-powered features like Smart Compose and Google Assistant
Microsoft 365
Requires on-premises Exchange Server for hybrid deployments
Real-time collaboration in Office apps (web-based)
Separate admin consoles for Exchange, SharePoint, etc.
Integrated with Azure Active Directory and Azure services
AI features like Microsoft Copilot (add-on)
Mistake
Google Workspace requires an on-premises server for email.
Correct
Google Workspace is fully cloud-based. Email is hosted and routed through Google's servers. There is no on-premises component required, though admins can use GCDS to sync from on-premises directories.
Mistake
Google Drive files are stored locally on the user's computer.
Correct
Files are stored in Google's cloud. Drive for Desktop caches files locally for offline access, but the primary storage is cloud-based.
Mistake
Shared Drives are owned by the user who creates them.
Correct
Shared Drives are owned by the organization. When a user leaves, the files remain. This is a key difference from My Drive, which is owned by the user.
Mistake
Google Vault only archives Gmail messages.
Correct
Vault supports Gmail, Drive, Chat, and Meet recordings. It provides eDiscovery, retention, and legal holds across multiple services.
Mistake
All Google Workspace editions offer unlimited storage.
Correct
Only Business Standard, Business Plus, and Enterprise editions offer unlimited storage (with some practical limits). Business Starter has 30 GB per user.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Google Workspace is the rebranded name for G Suite (announced in October 2020). The core products are the same, but Workspace introduced new features like Google Chat rooms (now Spaces) and tighter integration between apps. The GCDL exam uses the term Google Workspace.
For Enterprise editions, admins can set data region policies to specify where data is stored (e.g., United States, Europe). This is configured in the Admin Console under Data Regions. For other editions, data may be stored in any Google data center.
Yes, you can start with a free Gmail account, but for business use, you need a custom domain (e.g., @yourcompany.com). Workspace Business and Enterprise editions require a domain.
Business Starter: 100 participants. Business Standard: 150. Business Plus: 500. Enterprise: 250 (or 500 with add-on). The exam may ask about these limits.
Use Google Workspace Migrate (for email, calendar, contacts) or third-party tools. For files, use Drive for Desktop to sync local files. The exam may ask about migration considerations like DNS cutover and user training.
Cloud Identity provides identity and access management for Workspace users. It manages user accounts, groups, and authentication. Workspace uses Cloud Identity as its identity layer, and Cloud Identity can be used standalone for GCP-only organizations.
Yes, Gmail and Drive support offline access via Chrome browser extensions. Docs, Sheets, and Slides can be edited offline if enabled. Drive for Desktop also supports offline files.
You've just covered Google Workspace Productivity Suite — now see how well it sticks with free GCDL practice questions. Full explanations included, no account needed.
Done with this chapter?