Provide more secure access to data & resources

As an administrator, you can grant access to sensitive information and resources using security groups. You can make any group a security group. These groups appear with the Security label in the Groups list.

When to use security groups

Mark a group as a security group to:

  • Prevent external or nonsecurity groups from joining—Only a security group in the same organization can join another security group.
  • Ensure that member groups only include members allowed by the parent—A group joining a security group must have the same or more restrictive membership permissions.
  • Apply security policies to a group—We recommend making any group that you apply policies to a security group. However, to enforce policies using a dynamic group, you must make it a security group. For details, on this page, see Automate security policies using dynamic security groups.
  • Disable the option to allow all organization users to automatically join the group—Security group membership is limited to the users, service accounts, and security groups you permit.

Create a security group

You can create a group as a security group. 

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu ""and then"" Directoryand thenGroups.
  3. Click Create group.
  4. Enter the group informationand thencheck the Security boxand thenclick Next.
  5. Fill out the access settingsand thenclick Next.
  6. Enter the security settingsand thenclick Create Group
  7. Click Done.

For details on entering group information and settings, see Create a group.

Change a group into a security group

After you add a Security label to a group, it takes on the qualities of a security group. This process adds security features but doesn’t remove any other features of the original group. This action is permanent.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu ""and then"" Directoryand thenGroups.
  3. Click on the group nameand thenGroup Informationand thenLabels.
  4. Check the Security box.
  5. Click Save.

Automate security policies using dynamic security groups

To enforce policies using dynamic groups, add a Security label to them. For example, you might create a dynamic group to set policies for everyone at your organization who works in a specific geographic location. As users move and change their location in their user profile, the system automatically adds or removes them from the group.

  1. Create a dynamic group of users who meet the criteria you want.
  2. Add a Security label to the group.
  3. Create a policy and choose which policies take precedence by following the steps in Customize service settings with configuration groups.
Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

Search
Clear search
Close search
Google apps
Main menu
Search Help Center
true
73010
false
false