In Google Workspace, administrators and users occasionally encounter the explicit restriction: “User is not in the required Organizational Unit” when assigning Shared Drive permissions, creating new drives, or delegating administrative roles. This error indicates a policy conflict: the account attempting the action, or the user being added, resides in an Organizational Unit (OU) where that capability is prohibited. Resolving the block requires auditing OU assignments and adjusting policy inheritance in the Admin Console.
Quick Answer
This error occurs when an administrator assigns a role, Shared Drive membership, or administrative privilege that is restricted for the user’s specific Organizational Unit. To fix it, move the user account to an Organizational Unit that permits the feature, or adjust the service policies for their current OU in the Google Admin Console.
How Organizational Units Govern Shared Drive Capabilities
Organizational Units (OUs) structure users, devices, and settings across a Google Workspace tenant. Unlike groups, which manage communication and file sharing lists, OUs control service availability and feature permissions:
Organizational Unit Hierarchy & Policy Enforcement:
[Root Organization Domain]
├── [Staff / Faculty OU] ──> Shared Drive Creation: ON | External Sharing: ON
│ └── [Leadership OU] ──> Full Administrative Privileges
└── [Contractors / Students OU]──> Shared Drive Creation: OFF | External Sharing: OFF
When an operation triggers “User is not in the required Organizational Unit,” Google’s policy engine has detected that the user’s OU lacks the necessary entitlement for that action.
Common Scenarios Triggering the Error
1. Adding a Restricted User as a Shared Drive Manager
An administrator or team lead attempts to add an employee or student as a Manager on a Shared Drive. However, the tenant’s security baseline restricts managerial rights to full-time staff OUs. If the target user resides in a “Contractors,” “Interns,” or “Students” OU where managerial controls or external sharing capabilities are blocked, Google Drive rejects the assignment.
2. Creating a Shared Drive from an Unauthorized OU
When a user attempts to create a new Shared Drive, Google Drive checks their OU permissions under:
Apps > Google Workspace > Drive and Docs > Sharing settings > Shared drive creation
If creation is set to “Prevent users in [OU] from creating new shared drives,” the user cannot create drives, and adding them to existing administrative workflows will return an OU restriction error.
3. Service Status Disabled for the Target OU
In enterprise and educational environments, Google Drive may be toggled OFF for specific OUs (such as archived accounts, automated service users, or specific student grade bands). If you attempt to add an account from an OU where the Drive service is disabled into a Shared Drive membership list, the system rejects the user because they lack a valid Drive profile.
4. Admin Role Delegation Conflicts
When assigning delegated administrator privileges (such as Drive Administrator or Help Desk Administrator), the assigning Super Admin may restrict the scope of the administrative role to a specific OU. If the delegated admin attempts to modify a Shared Drive containing users outside their administrative scope, the operation fails with this alert.
Step-by-Step Remediation in Google Admin Console
Resolving the conflict requires verifying which OU the target user belongs to, followed by adjusting either their OU assignment or the policies applied to that OU.
Step 1: Identify the User’s Current Organizational Unit
- Sign in to admin.google.com as an administrator.
- In the left navigation menu, go to Directory > Users.
- Search for the user’s name or email address.
- Open the user profile and check the Organizational Unit listed under their account details.
User Directory Inspection:
┌─────────────────────────┬──────────────────────────┬────────────────────────┐
│ User Name │ Email Address │ Organizational Unit │
├─────────────────────────┼──────────────────────────┼────────────────────────┤
│ Jane Doe │ jdoe@company.com │ /Contractors/External │ <-- Restricted OU
└─────────────────────────┴──────────────────────────┴────────────────────────┘
Step 2: Option A – Move the User to an Authorized OU
If the user was misclassified during provisioning (e.g., an employee placed in a contractor or temporary OU):
- In the user profile page, click More options (or Change organizational unit).
- Select the target OU that possesses full Shared Drive permissions (e.g.,
/Corporate/Staff). - Click Continue and confirm the move.
- Allow up to 15 minutes for directory propagation, then retry adding the user.
Step 3: Option B – Update Policies for the Existing OU
If the user belongs in their current OU, but that entire group requires access to the feature:
- Navigate to Apps > Google Workspace > Drive and Docs > Sharing settings.
- In the left panel, select the user’s specific Organizational Unit.
- Under Shared drive creation, select Allow users in [OU] to create new shared drives (if drive creation is required).
- Under Sharing outside of [Organization], adjust sharing settings to match organizational needs; see Why Shared Drive External Sharing is Blocked.
- Click Save (or Override if inheriting from a parent OU).
Verifying Inheritance and Permissions
After making OU adjustments:
- Verify that the user holds the correct access level (Viewer, Contributor, Content Manager, or Manager) using Fix: “Manager” vs. “Content Manager” Conflict.
- If adding members continues to fail after policy updates, confirm that the Shared Drive has not exceeded directory size limits using Fix: “Can’t add members” to Google Shared Drive.
- For domain-wide compliance reviews, follow How to Audit Permissions via Google Admin Console.