Use groups to customize service access

If you have fewer than 50 users, it might be simpler to use only organizational units to Turn a service on or off for Google Workspace users.

As an administrator, you can turn on services for a group of users rather than an entire organizational unit. This lets you control access for specific users without changing your organizational structure. For example, turn on Google Drive and YouTube for a group of users within your marketing and sales teams.

Access groups can include any users or groups in your organization. You can create a group as an access group or use an existing group.

In this article:

Methods of giving users access to services

In the Google Admin console, you can turn off an organizational unit’s access to a Google service, such as Google Drive. If some users in that organizational unit need to use Drive, you have 2 options:

  • Move the users to an organizational unit that has Drive turned on.
  • Add the users an access group and turn on Drive for the group. Each member can access the service, even if their organizational unit has the service turned off. 
Organizational units With an access group
Organizations have the service turned off An access group has the service turned on
Google Drive is turned off
for organizational units 1 and 2
But a group of users within organizational units 
1 and 2 can use Google Drive

How to use access groups

Access groups can turn on user access to Google services. An access group can’t turn off user access to a service that’s turned on for an organizational unit.

  • An access group can contain any users or groups in your account. You can use your existing groups, for example, sales@example.com.
  • Access groups control only whether a service is on for a user. You set the service settings (such as Drive sharing) for an organizational unit or configuration groups (available for some services). Learn more

Compared to organizational units

  Access groups Organizational units
Function

Turn on services.

  • Turn services on or off.
  • Configure service settings.
Service access Turn on service for users in the group. Always overrides the organizational unit's setting. Turn service on or off for users in the organizational unit.
Services supported
User membership Users from different organizational units can belong to a group. Users can belong to multiple groups. A user belongs to a single organizational unit.
Inheritance Yes. Groups within a group get access to the service. Yes. Organizational units can inherit or override the parent organizational unit setting.
Automatic user licensing No Yes

Compared to configuration groups

To customize service settings for a group of users in one or multiple organizational units, you can use configuration groups. Here’s how configuration groups differ from access groups:

  • Access group—Turn on a service for a group of users, even their organizational units have the service turned off.
  • Configuration group—Customize service settings (for example, Drive Sharing options) for a group of users that are different from their organizational unit’s settings. For details, see Customize service settings with configuration groups.

The same group can be an access group and a configuration group. You can use one group to give users access to a service and customize settings for the service.

Set up an access group

Follow these steps to create and turn on services for an access group.

Note: To set up access groups for password vaulted apps, see Get started with password vaulted apps.

Open all   |   Close all

Step 1. Create the list of users and their organizational units

Identify the organizational unit for each user that you want to place in the access group. For services included with certain editions, such as Google Vault, check that users have licenses assigned.

Step 2: Choose organizational unit settings for the service

Choose the service settings for each organizational unit identified above. For example, turn external Calendar sharing on or off or turn off access to specific services. These settings apply for the entire organizational unit. Later, you can turn on service access for your access group.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu ""and then"" Apps.
  3. Click the type of service: Google WorkspaceAdditional Google services, Web and mobile apps, or Google Workspace Marketplace apps. 
  4. Select the organizational unit for a user in the access group.
  5. On the right, click the service.
  6. Choose the settings for the service.
  7. If needed, repeat for the organizational units of the other group members.
Step 3: Create the access group
  1. Create a group using the Admin console, Google Groups for Business, Directory API, or Google Cloud Directory Sync. Or use an existing group that was created with one of those tools. You can also use dynamic groups, including those with a security label.  

    Note: You can’t use a group created with Google Groups (groups.google.com). The Admin console doesn’t show whether a group was created in Google Groups. 
  2. Add users or other groups to your access group. 
  3. (Optional) Set permissions for the access group. For example, you might turn off posting to the group or add a group owner. For steps, go to Update group details. If you use the Groups Settings API, it has additional settings, such as preventing users from leaving a group.
Step 4: Turn on the service

For this step, you need admin privileges for Groups, Organizational Units (top-level), and Service Settings. Learn more about Administrator privilege definitions.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu ""and then"" Apps.
  3. Click the type of service: Google WorkspaceAdditional Google services, Web and mobile apps, or Google Workspace Marketplace apps. 
  4. In the Groups section, find and select your group:

    Click the Groups list on the left

    • To view the list of access groups, click Search for a group.
    • Search by group name or address.
      If you don’t find your group, it might be a group created in Google Groups, which can't be used as an access group.  
  5. On the right, point at the row for the service.

    Find  the Turn On link next to an app

    • To turn on access, click Turn On.

    • To remove access for the group, click Unset. Now, users get the access setting of their organization. However, if the users belong to any other access group with the service turned on, they continue to have access to the service.

    • To set multiple services, check the box for each service and click On or Unset in the upper right. 

Changes typically take effect in minutes but can take up to 24 hours to propagate to all users.

Step 5: Check service access

In the Admin console, you have 2 ways to find which services are turned on for an access group:

  • Check the services turned on for a user and then check that user’s group memberships.
  • View the access group for a service 

Check a user in the group

Note: If you check the service status of a user’s organizational unit, it’s Off because the service is turned off for their organizational unit. The service statuses (On, Off, On for some) are based only on an organizational unit's setting, not access groups.

View the access groups for a service

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu ""and then"" Apps.
  3. Click the type of service: Google WorkspaceAdditional Google services, Web and mobile apps, or Google Workspace Marketplace apps. 
  4. At the top left, click All users in this account.

    Fnd the All users in this account link on the upper  left

  5. Find a service with the status of On for some. This status indicates that the service is turned on for an organizational unit or access group.

    Note: If you check the service status of a user’s organizational unit, it shows Off if the service is turned off for their organizational unit—even if the service is turned on for the user’s access group. The service statuses (On, Off, On for some) are based only on an organizational unit's setting, not access groups.
     
  6. Point at On for some and click View details.

    Find the View Details link next to the app

  7. Review the service status for all groups and organizational units.

    The services status shows on or off

Step 6: Get users started with their service

Tell your users about their new service and share tips, guides, and training

View services for users, groups, and organizational units

Check services and groups for a user

On this page, go to Step 5: Check service access.

See the services and organizational units for access groups

On this page, go to Step 5: Check service access.

Verify a service’s status
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu ""and then"" Apps.
  3. Click Google Workspace or Additional Google services.
  4. On the left, select the view.

    Fnd the All users in this account link on the upper  left

View Actions for the service Status for the service
All users in this account

Turn on for everyone

or

Turn off for everyone (this unsets all access groups)

Status is based on groups and organizational units.
  • On for some
  • On for everyone
  • Off for everyone
Groups

On or Unset

  • On
Organizational Units

On or Off

Status is based only on organizational units.
  • On for some
  • On
  • Off

Edit access groups

Turn on or unset a service for an access group

On this page, go to Step 4: Turn on the service.

Turn a service on or off for everyone
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu ""and then"" Apps.
  3. Click the type of service: Google WorkspaceAdditional Google services, Web and mobile apps, or Google Workspace Marketplace apps. 
  4. On the left, click All users in this account.

  5. Point at a service and click More ""and thenselect Turn Off for everyone or Turn On for everyone.

    • Turn Off for everyone—Unsets access groups (no longer shown as On).

    • Turn On for everyone—No change to access groups settings.

Manage group membership

When you remove members from or delete an access group, the members no longer have access to services through that group.

Troubleshooting

I don’t see the access group on the apps page
  • The group might have been created in Google Groups and can't be used as an access group.
  • Search for the group address rather than the group name.
  • Try refreshing the apps page. Changes typically take effect in minutes but can take up to 24 hours.
  • Check that you have the Groups admin privilege.
The user is in an access group but can’t sign in to their service
  • Check a user’s services and group membership. The user might need to wait up to 24 hours before the access group settings take effect.
  • Check that the user has a license assigned for the service.
I turned on an access group, but the service status is off for all organizational units

The service status shows whether service is on or off for the organizational unit. It doesn’t indicate whether the organizational unit contains users in an access group. To check an access group’s services settings, follow the first 4 steps in Step 4: Turn on the service.

Related topics

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

Search
Clear search
Close search
Google apps
Main menu
Search Help Center
true
73010
false
false