When deploying Trustifi in a limited scope, choosing to deploy to a specific Org Unit (or multiple OUs) is the most convenient option in many cases.
While Google do not directly support filtering email traffic by OUs in their email routing rules, this can be done by creating a custom group that contains all members of the OU.
To deploy Trustifi to an OU using this method, please follow the steps below.
Step 1 – Verifying the API integration
Before creating the new deployment group, you will need to make sure you have an existing API integration between Trustifi and your Google tenant and that your Google groups are synced.
If you have not done this yet, please follow the steps in our Google API integration guide.
Step 2 – Editing existing permissions
For this part you will need to be signed in to the Google admin portal as an admin.
Navigate to the “API controls” section by searching for this input in the global search bar.
Then, scroll to the bottom and click on “Manage domain wide delegation“.
Under “Domain wide delegation” you should find the Trustifi API client and its existing permissions/scopes.
Hover over the Trustifi API client permissions and click on “Edit“.
Step 3 – Adding new API scope
A pop-up window will open, and you will need to scroll down to the bottom of the API scopes list until you find a new row where you will add the following scope:https://www.googleapis.com/auth/admin.directory.group
Once you’ve added this scope, click on “Authorize” to save the changes.
Step 4 – Exporting users in the Org Unit
To create a group based on the Org Unit users, you will need to export the existing OU users to a CSV file. To do this, follow these steps:
- Navigate to “Directory” > “Users“
- Under “All organizations” select “Users from selected organizational units“
- Select the relevant OU
- Click on “Download users“
A pop-up window will open, follow the settings pictured below and click on “Download“.
When the file is ready to download, a new “Task” pop-up will appear in the top-right.
Click on “Download CSV” to download the file.
Step 5 – Creating the OU group
To create a group based on the OU users, please send the exported CSV file to Trustifi: either to your account manager or to support@trustificorp.com
The Trustifi team will then create a group in your Google tenant based on the provided users from the OU.
Once this group is created, you can use it to deploy Trustifi only to these specific users, using the existing Google “group” filter as specified in our main limited scope deployment guide.