> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/gcp/gcp_in_ou.md).

# GCP\_IN\_OU

## Summary

|                            |                              |
| -------------------------- | ---------------------------- |
| **Forestall ACL Alias**    | GCP\_IN\_OU                  |
| **GCP Alias**              | Entity Relation (Structural) |
| **Affected Object Types**  | Users, Organizational Units  |
| **Exploitation Certainty** | Certain                      |

## Description

`GCP_IN_OU` is a structural edge representing that a Google Workspace User or Organizational Unit is **contained within an Organizational Unit (OU)** in the Google Workspace directory:

```
User ─── GCP_IN_OU ───► Organizational Unit
Child Organizational Unit ─── GCP_IN_OU ───► Parent Organizational Unit
```

The edge points from the contained object to its parent OU. A User belongs to exactly one OU at a time, while child OUs form a hierarchy beneath the root OU. The root OU itself is connected to the Customer by [`GCP_PARENT`](https://docs.forestall.io/fsprotect/edges/gcp/gcp_parent).

OUs structure the Workspace directory and apply policies selectively. Password policies, device policies, app access settings, and Context-Aware Access rules applied to a parent OU cascade to its child OUs and Users unless overridden.

**Key properties:**

* The edge points from a User or child OU to its parent OU.
* A User belongs to exactly one OU at a time.
* OU-level policies apply to members and descend through the OU hierarchy unless overridden.
* Moving a User or OU can change which inherited controls apply.

## Identification

### Google Admin Console

1. Open **Google Admin Console** (`admin.google.com`) → **Directory** → **Organizational units**.
2. Expand the OU tree to identify each child OU's parent.
3. Select an OU to view its directly assigned Users.

### Admin SDK Directory API

```bash
ACCESS_TOKEN="your-access-token"

# List all OUs and their parent paths
curl -s \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  "https://admin.googleapis.com/admin/directory/v1/customer/my_customer/orgunits?type=ALL" \
  | jq '.organizationUnits[] | {name: .name, path: .orgUnitPath, parentPath: .parentOrgUnitPath}'

# Get a User's OU placement
USER_EMAIL="user@example.com"
curl -s \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  "https://admin.googleapis.com/admin/directory/v1/users/${USER_EMAIL}?projection=full" \
  | jq '{email: .primaryEmail, orgUnitPath: .orgUnitPath}'
```

## Exploitation

`GCP_IN_OU` has no direct exploit. Its security significance comes from OU-level policy inheritance:

* **Move a User to a less-restricted OU** to bypass Context-Aware Access policies, app-access restrictions, or stricter MDM requirements applied to the original OU. Moving a User requires an appropriately privileged Workspace administrator.
* **Move a child OU** beneath a less-restricted parent to change inherited controls for every User and nested OU below it.
* **Modify OU-level policies** to relax security controls for all members and descendants simultaneously.
* **Map a target's effective controls** by following its OU and ancestor OU edges.

## Mitigation

1. **Restrict User and OU moves** to dedicated directory administrators and require change approval for sensitive OUs.
2. **Keep privileged accounts in hardened OUs** with the most restrictive access policies.
3. **Alert on hierarchy and membership changes** involving executives, administrators, finance Users, and other sensitive populations.
4. **Layer security controls** instead of relying solely on OU membership; use groups and Context-Aware Access as additional enforcement layers.
5. **Review inherited settings after OU moves** to ensure the destination hierarchy does not weaken required controls.

## Detection

| Log Type       | Method                  | Key Fields                                    |
| -------------- | ----------------------- | --------------------------------------------- |
| Admin Activity | `MOVE_USER_TO_ORG_UNIT` | Actor, target User, source OU, destination OU |
| Admin Activity | `MOVE_ORG_UNIT`         | Actor, target OU, previous parent, new parent |
| Admin Activity | `CREATE_ORG_UNIT`       | Actor, new OU, parent OU                      |

```bash
ACCESS_TOKEN="your-access-token"

# User OU membership changes
curl -s \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  "https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOVE_USER_TO_ORG_UNIT" \
  | jq '.items[]? | {actor: .actor.email, time: .id.time, params: .events[].parameters}'

# OU hierarchy changes
curl -s \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  "https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOVE_ORG_UNIT" \
  | jq '.items[]? | {actor: .actor.email, time: .id.time, params: .events[].parameters}'
```

Alert on:

* Users moved from a restricted OU to a less-restricted one.
* Child OUs reparented beneath a hierarchy with weaker inherited controls.
* OU membership changes for privileged or executive accounts.
* Bulk User moves or hierarchy changes outside an approved maintenance window.

## References

* <https://developers.google.com/admin-sdk/directory/reference/rest/v1/orgunits>
* <https://knowledge.workspace.google.com/admin/users/advanced/add-an-organizational-unit>
* <https://knowledge.workspace.google.com/admin/users/advanced/how-the-organizational-structure-works>