Customize G Suite settings with configuration groups

You can apply G Suite service settings to a group of users rather than an entire organizational unit. This lets you customize settings for specific users without changing your organizational structure.

 Use groups to configure settings for:


  * Available only with certain editions of G Suite


Use organizational units to configure all other service settings (such as POP/IMAP settings for Gmail).

Using configurations groups for service settings

With configuration groups, you can customize service settings for a group of users. For example, let a group approve YouTube videos or a team share Drive files with people outside of your organization.

Configuration groups can include users from any organizational unit in your account. You can create a group or use an existing group in your account, such as

Typically, you apply services settings to organizational units, and then make exceptions for some users. For example, you can restrict YouTube content for everyone in your account but let some groups view all videos or approve videos.

Configuration setting example for YouTube

How configuration groups work

  • Configuration groups can contain any users in your organization. Also, you can add your groups (nested groups).

  • A user’s group settings always override their organizational unit's settings.

  • A user can belong to multiple configuration groups, unlike organizational units. You set the priority of configuration groups, and the user gets the setting of the highest priority group they belong to.


  • You must create your configuration groups in the Admin console, Google Cloud Directory Sync, or Directory API. Then you can edit the groups in those tools or Google Groups.

  • You can set up and apply configuration groups only in the Admin console (not available in G Suite APIs).

To get started, skip below to "Set up configuration groups"

Managing large numbers of users or policies

Information and tips for admins who manage a medium to large organization. Or anyone interested in details about configuration groups.

Open all | Close all

Options for configurations groups

Before you create or apply configuration groups, you'll typically map your user groups to their settings. For example, these user groups have different permissions for sharing Drive files.

  Drive sharing permissions
User group Share with
any domain
Share with
trusted domains
only internally
Sales Managers    
Sales Team    
Sales Operations    


Next, you can use configuration groups based on your user groups or user settings, or a combination that fits your organization.

Option 1: Use configuration groups based on user groups

Use your user groups as configuration groups. Then choose the settings for each configuration group. If a user belongs to multiple groups, you set which group determines the user's settings (described later in the Priority section).

For example, with Drive settings, you can let specific user groups share files externally.

Image of applying setting to groups

Applying settings directly to user groups is a good option for:

  • Organizations with fewer than 50 users or a small number of settings. You don't need to create more groups and you can finely tune settings for each user group.
  • Testing a service setting.
  • Apps used by a specific group of users. For example, if you have AppMaker developers, you can set their default Cloud SQL instance for storing app data.

Option 2: Create configuration groups based on user settings

If you manage many settings or users, you might create groups for different levels of settings.

For example, create a configuration group for each level of Drive sharing permissions. Then, add your user groups as members of the configuration group.

Drive settings by configuration group

With this option, a configuration group acts as a container for settings. You typically have fewer configuration groups to manage and prioritize (described below). Also, you can use the Groups API or Directory Sync to manage user and group membership. 

Setting priority for configuration groups

When a user belongs to multiple configuration groups, you set which configuration group has priority in determining the user’s setting.

In the Admin console, groups are listed from highest to lowest priority. The user gets the settings of the highest priority group they belong to.

You change the priority of configuration group by moving the group up or down in the Groups list. Setting priority order is available only in the Admin console and not any of the APIs.

Groups panel


How priority works

When a user belongs to multiple groups, they get the settings of their highest priority group. In this example, a sales manager belongs to 3 user groups and each group has different setting for Directory Profile editing. 

With the configuration groups in this priority order, Sales managers can edit their name and location in their Directory profiles.

Mapping of configuration groups to member

If the Edit location group is the highest priority, Sales managers can edit only their location and Regional sales can edit their name and location.

Changing group priority

User settings and multiple groups

Settings aren't added across a user's groups. In this example, a Marketing manager, belongs to 3 groups but gets the settings only of the highest priority group. They can edit their name and location, but not their photo.

User belonging to multiple groups

Ordering groups

For Drive settings, changing group priorities or membership can affect file sharing and access.

For example, if you transfer ownership of a file to a user in another configuration group, the file's sharing permissions change to the permissions of the new group.

To track of priority and settings:

  • Consider priority in your group structure and watch for deeply nested groups, which may be challenging to trace to settings. 
  • When you order your configuration groups, you might consider placing the group that applies to the fewest people as the highest priority. 

Planning and designing configuration groups

Planning your configuration group structure is likely the step that takes the most time and review. 

Mapping your service settings

You might review your organizational units for settings that you want to manage with groups. If you already use a roles-based or teams approach to settings, you can use groups in the same way.

Policies with roles and teams

If your account has multiple editions of G Suite (Basic, Business, Enterprise):

  • The configuration group settings apply only to users who have access to the feature or service. For example, only the group's members assigned a G Suite Enterprise license can record video meetings with Meet. 
  • With G Suite Basic, Drive settings apply to your entire organization. You can use configuration groups to customize Drive settings for users with a G Suite Business or Enterprise license. Any group member assigned a G Suite Basic license gets default Drive setting for your organization. 

Setting naming standards

Choose a group naming standard for easier searching, prioritizing, and auditing. For example, use a standard that includes the setting name and priority number. The Groups list shows a maximum of 37 characters of a group name. Pointing at a group shows the full name.


If you manage many types of groups, you might add a prefix such as "cf" to indicate a configuration group. Also, use a decimal place to avoid editing your existing group names when you add a configuration group.


Creating groups

You must use groups created in the Admin console, Directory API, or Google Cloud Directory Sync. Groups created in Google Groups can’t be used as configuration groups. (The Admin console doesn’t show whether a group was created in Google Groups.)

You can manage the configuration group in any tool. You might set strict permissions for adding/deleting users, turn off posting to the group, or prevent users from leaving the group (available only in the Groups API). 

Set up configuration groups

Open all | Close all

Step 1. Apply the configuration group

For this step, you need admin privileges for Groups, Organizational Units (top-level), and Service Settings.​

Before you start: Choose your group. You use an existing group or can create a group

You can't use groups created in Google Groups. Only groups created in the Admin console, Directory API, or Google Cloud Directory Sync can configure settings.

  1. In the Admin console, go to the settings page for the app.
  2. Click the settings you want to edit. For example, here are the YouTube settings for your top-level organization. 

    YouTube settings for organization
  3. On the left, click Groups. Any existing configuration groups are listed in order of priority.

  4. Click Search for a group. The results include all your groups, not only configuration groups.
  5. Enter a group address (rather than the name of the group) and then select the group.
    • If you don’t find your group, it may have been created in Google Groups . Configuration groups mus be created in the Admin console, Directory API, or Google Cloud Directory Sync.
    • Start by adding your configuration groups from highest to lowest priority. When you add new group, it’s placed at the lowest priority.
  6. Choose the settings for your configuration group. By default, a new group has the settings of your top-level organizational unit.  

    YouTube settings for a group

    For organizations with multiple types of G Suite licenses: If you have licenses for a G Suite edition that doesn't include a certain setting, a flag Flag image for multiple licenses appears next to the settings for a group. This flag appears whether  or not the group contains users who don't have the required license.

  7. Turn on or off the configuration group.
    • Turn ON the group: Click Save.
      The settings are applied to the configuration group’s members. To close the panel, click Cancel
    • Turn OFF the group: Click Unset or click Remove ""  in the Groups panel (clicking Cancel won't remove the group).  
  8. Adjust the priority of the group by dragging the group up or down. Changes typically take effect in minutes, but can take up to 24 hours.
    • To set a group as priority 1: Drag your desired group up to priority 2, then drag the current priority 1 below. You can also enter a number in priority box or click the arrows next to the priority box.
    • If you have fewer than 4 groups: you reorder groups containing the same users, those users get the setting of their highest priority group. You may get this alert:

      “More than one policy may be linked to the same users...

      This general alert appears if you add, unset, or change the priority of any configuration group, even if the groups don’t contain the same users.
Step 2. Check the settings for a user

For this step, you need admin privileges for Groups, Organizational Units (top-level), and Service Settings.

  1. In the Admin console, go to the settings page for the app. 
  2. In the top left, click Users.
  3. Click Select a user and search for the user’s address (not name).
  4. Select the user to view their settings. Below name of the settingyou can click the configuration group or organization unit that determined the user's settings.

    Profile information

Note: If you check the user's organizational unit, the service setting won't show as Overridden. The settings, Overridden and Inherited, are based only on an organizational unit's setting, not on configuration groups.


I don’t see the Groups list

  • The configuration groups feature is available for AppMaker, Data regions, Directory Profile editing, Drive, Hangouts (Meet settings), Voice, and YouTube. Also, configuration groups for Drive and Data regions aren't available with G Suite Basic or legacy free edition.

I don’t see the configuration group in the Groups list

  • The group may have been created in Groups for Business. Try creating a group in the Admin console.
  • Search for the group's email address rather than the group's name.
  • Try refreshing the setting page. Changes typically take effect in minutes, but can take up to 24 hours.
  • Check that you have admin privileges for Groups.

A user doesn't have the correct service settings

  • Check a user’s group membership. It may take up to 24 hours before the group settings take effect.
  • Find the configuration group that's determining the user's settings. If the user belongs to multiple configuration groups, you might need to change the group priority or user's group membership.
  • The user may not have the product license for the feature. Some features, such as Shared Drives, are available  only with certain editions of G Suite.
Review changes in the Audit log

The event Application Setting Group Priorities Change logs when you apply a configuration group or change order of priority. The event uses the group name rather than the group address. You might want to use a similar naming standard for both your group name and addresses.

For example, you apply the group Link anyone to the Drive Link Sharing setting. 

Application Setting Group Priorities Change
For Drive and Docs, group override priorities for Link Sharing 
changed to Link anyone

When you change the priority of groups, the event lists the groups in their new order, from lowest to highest priority.

Application Setting Group Priorities Change
For Drive and Docs, group override priorities for Link Sharing 
changed to No Links < Link users < Link anyone

Most other events use a similar format for both organizational units and configuration groups. The prefix, group_email, identifies a configuration group.

For example, overriding settings with an organizational unit:

Drive Setting Change
(org_unit_name: { Marketing}

Applying settings with a configuration group:

Drive Setting Change
(org_unit_name: {}, group_email: {})

For events with configuration groups, your top-level organizational unit is always listed as the org_unit_name.

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue