Set up group sync

This page is for Directory Sync. If you’re using Google Cloud Directory Sync (GCDS), go to GCDS. Directory Sync is currently in public beta.

Directory Sync syncs the group name, group attributes, and membership to your Google cloud directory.

Before you begin

You must set up a user sync before you set up a group sync. For details, go to Set up user sync.

Set up the groups to synchronize

Expand all  |  Collapse all

Step 1: Select the groups

Directory Sync does not sync security groups. 

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DirectoryDirectory sync.
3. Click the name of your external directory.
4. Click Set up group sync.
5. (Active Directory only) For Base DN, enter the base distinguished name (DN).

   Example: ou=Sales, dc=example, dc=com. In this example, Directory Sync searches for groups and subgroups under the Sales organizational unit.

6. (Azure Active Directory only) Choose an option:
   • To sync all groups in your external directory, select Sync all groups.
   • To sync specified groups, select Sync selected groups and enter the groups separated by a comma. Click Verify to check that the groups exist in your external directory.
7. Click Continue.

Step 2: Map the group attributes

1. For Required attributes, confirm or enter the external directory attributes that map to the following group attributes in the Google cloud directory:
   • Group email address (required)
   • Groups display name (required)
   • Group members (required)
   • Group owner (required)
   • Group description

   For supported Azure Active Directory attributes, go to group resource type: Properties.

2. Click Continue.

Step 3: Delete groups not found in the external directory (Optional)

Important: Once a group is deleted, it cannot be recovered.

You can delete a group in your Google cloud directory if it's not found by the group scope in your external directory. 

To delete groups not found in the external directory:

1. Check the Delete group in Google directory box.

   If you don't want to delete groups, uncheck the box.

2. Click Continue.

Step 4: Set safeguards

You can choose to set the conditions under which a sync is automatically canceled. If the sync exceeds the safeguard limits, the sync is automatically canceled and no groups are deleted. No further syncs will run until you manually enable the sync.

To set a safeguard:

1. For Safeguards, select Set a percentage of groups or Set a total number of groups and enter a percentage or number.
2. Click Simulate Sync.
3. If a safeguard is triggered, you receive a notification from the alert center that gives details about the failed sync. You can also view additional details in the audit log. For more information, go to Use the alert center and Check log events for Directory Sync.

What happens next?

Directory Sync simulates a sync. Depending on the size of your data, the process can take up to an hour to complete.

View the status of a simulation

You can return to the directory details page to see the status of the simulation. You can also check whether the simulation is complete in the Directory Sync log events:

1. Open the Directory Sync log events.

   For details, go to Access Directory Sync log event data.

2. Click Add a filterEvent.
3. Select Sync Completed and click Apply.

   A Yes in the Simulation column indicates the simulation is complete. You might need to add the Simulation column to see the results.

Check the results of a simulated sync

When the simulation is complete, on the directory details page, click View Simulation log.

Related topic

Replace the domain name for synced users

Next step

Run a sync

_{Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.}