How to use this guide
These best practices provide tips, recommendations, and examples to supplement the instructions for the 3 primary steps you’ll follow to deploy a target audience. Make sure you review these instructions before deploying target audiences:
- Step 1: Create a target audience
- Step 2: Add members to a target audience
- Step 3: Apply a target audience to Drive
Creating a target audience
When creating a target audience, make sure you provide a useful name and description for it:
- Use a name that succinctly describes the membership of the target audience—The name can also help you identify which organizational unit or configuration group the audience is applied to. For example, if you’re creating an audience for your sales team on the East coast, and the team is in an organizational unit named "Sales - East Coast," you might want to use that name for the target audience.
- Provide a description describes the purpose of the target audience—This helps users choose the right level of sharing. The description appears when a user hovers over the name of an audience in their link-sharing settings.
Adding members to a target audience
Add groups instead of individual users as members
Although target audiences help users more easily share with specific people, they're still intended to encourage broad sharing and collaboration in your organization. It's usually best to add groups for departments or larger teams as members of a target audience rather than individual users.
Consider the types of groups you can add as members
You can add any type of group as a member of a target audience, including groups you create with Admin console, APIs, or another tool; groups users create; or groups created outside your organization. Here are some ways to streamline creation and management of groups you use for target audience membership:
- Keep group membership updated automatically—You can use dynamic groups to manage memberships automatically using queries, such as a query on job role or building location. Dynamic groups, available in the Admin console or with the Cloud Identity API, help you reduce time spent managing group membership manually when users join, move, or leave your organization. Learn more about dynamic groups.
- Keep groups more secure—You can convert a standard group to a security group, which helps you easily regulate, audit, and monitor the group for permission and access control purposes. External groups and non-security groups can’t be added to a security group. Security groups are available with the Cloud Identity Groups API. Learn more about security groups.
- Manage groups more easily—You can use the Admin SDK Groups API to create groups, or manage groups you create with other tools. Learn more about the Admin SDK Groups API.
- Use groups from Microsoft Active Directory or other tools—You can use Google Cloud Directory Sync to sync groups you create in Microsoft Active Directory or other tools with Google Workspace. Then, you can use synced groups “as is” in target audiences. Learn more about Cloud Directory Sync.
Consider how non-admin groups can affect security and privacy
Applying a target audience to Drive
You can apply up to 5 target audiences to a Drive and Docs policy. If you want users to choose a specific audience most often, make sure you make that the primary audience—that is, the default link-sharing option that appears when a user opens their link-sharing options.
Note: If you don't move a target audience you create to the primary position, the pre-defined audience, which includes all users in your organization, will remain the default audience.
To make an audience primary, drag it to the topmost position in the list of audiences:
The following examples show common ways organizations can deploy target audiences.
Limit link-sharing to only employees
If your organization has both employees and vendors, you can use target audiences to make it easier for your employees to limit link-sharing with vendors:
- Create two target audiences, named, say, “Employees Only” and “Employees and Vendors.” Make sure you add a clear description for each.
- Add all employees to the “Employees Only” audience. You can either create a dynamic group or use an existing group containing all permanent employees.
- Add all users in your organization to the “Employees and Vendors” audience. You can create a group containing all members of your organization and add it to the target audience. For details, see Add all organization users to a group.
- Create a Drive and Docs sharing policy for the target audiences. You can apply the policy to all users or just a specific organizational unit or configuration group. Make sure you set the “Employees Only” audience as the default audience by dragging it to the primary position.
Employees can now more easily avoid sharing items with vendors. If needed, users can still share items with specific vendor users.
Deploy target audiences across multiple Google Workspace accounts
If your organization has multiple subsidiaries, each with their own Google Workspace account, you can use target audiences to recommend that users link-share their files across subsidiaries. For example, you might want your Human Resources department to share documents with all subsidiary organizations. Here’s how:
- For each subsidiary Google Workspace account, create a group containing all users (if you don’t already have one). You can either create a regular admin group or a dynamic group, or use your existing tools to create the group.
- In the Google Workspace account for your parent organization, create a target audience, and name it, say, “All subsidiary employees.” Then add the groups you created in step 1 as members of this audience.
- Create a Drive and Docs sharing policy for “Human Resources team” target audience. You can apply the policy to your Human Resources organizational unit or configuration group. Optionally, set the “Employees Only” audience as the default audience by dragging it to the primary position.
Recommend progressively broader link-sharing options
You can create link-sharing options to let your users choose from narrow to broad link-sharing to help prevent accidental oversharing of information.
For example, assume your company has multiple business units. Each business unit works on different products, and multiple teams work on each product. Each teams’ members collaborate closely with each other, as well as collaborate with other teams on some products. Occasionally, a team needs to collaborate across all other business units or teams, such as for executive reviews and yearly planning. Finally, on rare occasions, a team member needs to share information with the entire company.
Here are the target audiences you would set up for one team—in order of priority in your Drive policy—to help users prevent oversharing:
- Team ABC (Primary)
Includes all users on the team
- Product Area
Users in all teams under the product area (including Team ABC users)
- Business Area
Users in all product areas under the business area
All users in the company
Deploy target audiences according to your organization’s hierarchy
You can create and recommend target audiences based on your organization’s unique hierarchy of organizational units or configuration groups. For example, if your organization has set up its hierarchy by job function and geography, here’s how you could set up target audiences for your Finance department in the UK, in order of priority in your Drive policy:
- Finance UK
Users in the Finance department in the UK
- Finance Global
Users in Global Finance (including UK’s Finance department)
All users in the company
Recommend how broadly to link-share across multiple secondary domains
If your organization's Google Workspace account includes multiple secondary domains, you can use target audiences to recommend how broadly users in your primary domain should link-share with the other domains.
For example, assume all employee accounts in your company are in your primary domain, and all partner and vendor accounts are in secondary domains. If employees link-share with the default target audience—which includes all users across all domains—they might be oversharing their files. You can use target audiences to help users limit their link-sharing with the secondary domains. Here’s how:
- Create a target audience, with the name, say, “Employees Only." Make sure you add a clear description.
- Add all employees in your primary domain as members of the “Employees Only” audience. You can either create a dynamic group or use your existing tools to create a group containing all permanent employees.
- Create a Drive and Docs sharing policy for the target audience. Apply the policy to all employees in your primary domain. Make sure you set the “Employees Only” audience as the default audience by dragging it to the primary position. This will move the pre-defined default audience (which contains all users in all domains) to the secondary position in employees’ link-sharing options.
Employees can now more easily avoid link-sharing items with vendors. If needed, users can still link-share items with all users across all domains. Partner and vendor users will continue to link-share broadly with the entire company.