3.5 Managing Groups (Google)

You should know the following terms:

• Access Group 
• Configuration Group 

How to use access groups

Access groups can turn on user access to Google services. An access group can’t turn off user access to a service that’s turned on for an organizational unit. An access group can contain any users or groups in your account

Access groups control only whether a service is on for a user. You set the service settings (such as Drive sharing) for an organizational unit or configuration groups. A configuration group allows you to customize service settings for a group of users that are different from their organizational unit’s service settings.

Setting up access groups

1. Create the list of users and their organizational units
2. Identify the organizational unit for each user that you want to place in the access group. For services included with certain editions, such as Google Vault, check that users have licenses assigned.
3. Choose organizational unit settings for the service

Choose the service settings for each organizational unit identified above. For example, turn on external Calendar sharing, or turn off access to specific services. These settings apply for the entire organizational unit. Later, you'll turn on service access for your access group. In your Google Admin console:

1. Go to Menu → Apps
2. Click the type of service: Google Workspace, Additional Google services, Web and mobile apps, or Google Workspace Marketplace apps. 
3. Select the organizational unit for a user in the access group.
4. Click the service on the right.
5. Choose the settings for the service.
6. If necessary, repeat for the organizational units of the other group members.

Create the Access Group

Create a group using the Admin console, Google Groups for Business, Directory API, or Google Cloud Directory Sync. Or use an existing group that was created with one of those tools.

Add other users to your access group Set permissions for the access group. For example, you might turn off posting to the group or add a group owner.

Turn on the service.

In your Google Admin console

1. Go to Menu → Apps
2. Click the type of service: Google Workspace, Additional Google services, Web and mobile apps, or Google Workspace Marketplace apps. 
3. In the Groups section, find and select your group. To view the list of access groups, click Search for a Group Search by group name or address. If you don’t find your group, it might be a group created in Google Groups, which cannot be used as an access group.
4. On the right, point at the row for the service. Click Turn On to turn on access.
5. To remove access for the group, click Unset. Now, users get the access setting of their organization. However, if the users belong to any other access group with the service turned on, they continue to have access to the service.
6. To  set multiple services, check the box for each service and click On or Unset in the upper right. 
7. Check Service Access. Note: Changes may take up to 24 hours.

Customizing service settings with configuration groups.

Here are additional resources you may find useful:

•  Difference Between Google Groups and Organizational Units (article)

Complete the following task or self-assessment:

Organize the users you added in the Managing Users section into at least two different groups: one access group and one configuration group.

Change access for an app or two for one of your groups. Change them back.

Reflect on the following:

• Did you run into any trouble? If so, where might you seek answers to your questions? Do you have any trusted colleagues you could speak with for assistance?
• What advice or tips might you offer to a new colleague in your role?