How to Create an Organizational Unit for EntrustedMail.

1. Point your browser to admin.google.com. The URL redirects you to the Google accounts sign-in page.
2. Enter your super administrator account email address (including username and domain) and password. (If you are not an Administrator, you will be redirected to the user hub. The user hub provides quick access to the G Suite and services they have permission to use, but will not allow access administration features. You will need to contact your G Suite Administrator)
3. Click Sign in. The Admin console appears.

4. Click on the Users tile.

5. Hover over the organizational unit to which you want to add a child organizational unit, and click the vertical dots that appears to the right.
6. Click Add sub organization.

7. Enter a name and description (optional) for the new organizational unit.

8. Click Create organization. The new organizational unit appears as a child of the organizational unit you selected.
9. In the organization tree, highlight the organizational unit that the user currently belongs to. If the user was not assigned to a specific organizational unit when his or her account was created, the account is in the top-level organizational unit; in the example shown here, our top organizational unit is entrustedmail.net.
10. Click the sender image, next to the name of the user you wish to move to your encryption group, so that it turns into a check box and check the box.
11. Next, select the “move to another organization” button   and select your encryption group.
12.  Confirm that you wish to move the selected users to your encryption group.

13. Go back to the G Suite Home Screen.
14. Click Apps
15. Next, click on G Suite
16. Then, click Gmail.
    
    
17. Scroll down and click on Hosts.
18. Next, click on Add route.
19. Enter a description (can be anything, we chose to use EntrustedMail). and then select multiple hosts.
20. Enter first Outbound Gateway Host, listed in your “Welcome E-mail”, as a Primary Host, type in the number 25 after the colon and enter 50 under Load %.
    Next, Click the Add Button and enter the second Gateway Host, listed in your “Welcome E-mail”, as a Primary Host, type in the number 25 after the colon and enter 50 under Load %.
    Then, enter the third Gateway Host, listed in your “Welcome E-mail”, as a Secondary Host, type in the number 25 after the colon and enter 100 under Load %.
21. Check both the “Require TLS delivery” and the Require CA signed certificate boxes.
22. Then click the Save button.
    
23. Scroll down and Click on “Advanced settings”.
24.  On the left side, under Organizations, check to be sure that your top level organization is select.
    
    
25. Scroll down to the “Inbound gateway” section.
    
26. Next, click the ADD button and Enter the inbound gateway IP ranges listed in your “Welcome E-mail” (this setting will assure that certain replies to your encrypted messages do not get blocked.) Each range will need to be entered individually.
    
27. Check the Require TLS option and DO NOT check the Reject all mail not from gateway IPs option. Automatically detect eternal IP should be checked unless you have existing ranges and this option was left unchecked previously.
28. On the left side, under Organizations, check to be sure that your newly created encryption organization is select.
    
    
29. Scroll down to the “Sending routing” section and click on Configure.
30.  Enter a description (can be anything, we chose to use Send Route to EntrustedMail.)
31.  Under “E-mail messages to affect” check Outbound
32. Under “Route” check Change route and then select the new mail route we created in Step 22.
33. Press the Add Setting button.
34. Be sure to save your changes one last time by pressing the Save  button shown below. Changes normally take affect in 5 – to 10 minutes. E-mail will continue to use your previous settings until the changes take affect.