Workspace ONE uses a hierarchical structure for its configuration - similar to branches on a tree. Each school has an Organizational Unit (OU), which is like a container for its devices, Profiles, Smart Groups, and apps. Within each school's OU are sub-OUs for Students and Teachers. Some schools also have an OU for Chromebooks, but these were only created for testing; we ultimately decided not to use Workspace ONE to manage Chromebooks.
The administrator at each school has an account which has permissions to view everything within the school's OU and also within all sub-OUs. The administrator cannot view elements associated with other branch OUs or higher-level OUs, because they belong to other schools.
At the top level, is an OU for DeSales Media Group and at this level, there are Smart Groups, policies, and apps which are assigned to your school, but you do not have the ability to modify them. For example, in the image below, you can see two Assignment Groups which are managed at the DeSales Media Group level.
