Configure G Suite service settings with groups

You can apply G Suite service settings to a group of users rather than an entire organizational unit. This lets you customize settings for specific users without changing your organizational structure.

Currently, you can use groups to configure settings only for:

  • AppMaker
  • Directory Profile editing
  • Drive (not available with G Suite Basic and legacy free edition)
  • Hangouts Meet
  • Voice
  • YouTube

Use organizational units to configure all other service settings (such as POP/IMAP settings for Gmail).

Using configurations groups for service settings

With configuration groups, you can customize service settings to a group of users. For example, let a group approve YouTube videos or a team share documents with non-Google Accounts.

Configuration groups can include users from any organizational unit in your account. You can create a group or use an existing group in your account, such as staff@example.com.

Typically, you apply services settings to organizational units, and then make exceptions for some users. For example, you can restrict YouTube content for everyone in your account but let some groups view all videos or approve videos.

Configuration setting example for YouTube

How configuration groups work

  • Configuration groups can contain any users in your organization. Also, you can add your groups (nested groups).

  • A user’s group settings always override their organizational unit's settings.

  • A user can belong to multiple configuration groups, unlike organizational units. You set the priority of configuration groups, and the user gets the setting of the highest priority group they belong to.

Requirements

  • Configuration groups must be created in the Admin console, Google Cloud Directory Sync, or Directory API. Then you can edit the groups in those tools or Google Groups for Business.

  • You can set up and apply configuration groups only in the Admin console (not available in G Suite APIs).

To get started, skip below to "Set up configuration groups".

Managing large numbers of users or policies

Information and tips for admins who manage a medium to large organization. Or anyone interested in details about configuration groups.

Open all | Close all


Options for configurations groups

Before you create or apply configuration groups, you'll typically map your user groups to their settings. For example, these user groups have different permissions for sharing Drive files.

  Drive sharing permissions
User group Share with
any domain
Share with
trusted domains
Share
only internally
Sales Managers    
Sales Team    
Sales Operations    

 

Next, you can use configuration groups based on your user groups or user settings, or a combination that fits your organization.

Option 1: Use configuration groups based on user groups

Use your user groups as configuration groups. Then choose the settings for each configuration group. If a user belongs to multiple groups, you set which group determines the user's settings (described later in the Priority section).

For example, with Drive sharing settings, you can let certain user groups share files externally.

Image of applying setting to groups

Applying settings directly to user groups is a good option for:

  • Organizations with fewer than 50 users or a small number of settings. You don't need to create more groups and you can finely tune settings for each user group.
  • Testing a service setting.
  • Apps used by a specific group of users. For example, if you have AppMaker developers, you can set their default Cloud SQL instance for storing app data.

Option 2: Create configuration groups based on user settings

If you manage many settings or users, you might create groups for different levels of settings.

For example, create a configuration group for each level of Drive sharing permissions. Then, add your user groups as members of the configuration group.

Drive settings by configuration group

With this option, a configuration group acts as a container for settings. You have typically fewer configuration groups to manage and prioritize (described below). Also, you can use the Groups API or Directory Sync to add/remove users or groups to a configuration group.

Setting priority for configuration groups

When a user belongs to multiple configuration groups, you set which configuration group has priority in determining the user’s setting.

In the Admin console, groups are listed from highest to lowest priority. The user gets the settings of the highest priority group they belong to.

You change the priority of configuration group by moving the group up or down in the Groups list. Setting priority order is available only in the Admin console and not any of the APIs.


 

How priority works

When a user belongs to multiple groups, they get the settings of their highest priority group. In this example, a sales manager belongs to 3 user groups and each group has different setting for Directory Profile editing. 

With the configuration groups in this priority order, Sales managers can edit their name and location in their Directory profiles.

Mapping of configuration groups to member

If the Edit location group is the highest priority, Sales managers can edit only their location and Regional sales can edit their name and location.

Changing group priority

User settings and multiple groups

Settings aren't added across a user's groups. In this example, a Marketing manager, belongs to 3 groups but gets the settings only of the highest priority group. They can edit their name and location, but not their photo.

User belonging to multiple groups

Ordering groups

For Drive settings, changing group priorities or membership can affect file sharing and access. For example, if  you transfer ownership of a file to a user in another group, the file's sharing permissions change to the permissions of the new group.

To track of priority and settings:

  • Consider priority in your group structure and watch for deeply nested groups, which may be challenging to trace to settings. 
  • When you order your configuration groups, you might consider placing the group that applies to the fewest people as the highest priority. 


Planning and designing configuration groups

Planning your configuration group structure is likely the step that takes the most time and review. 

Mapping your service settings

You might review your organizational units for settings that you want to manage with groups. If you already use a roles-based or teams approach to settings, you can use groups in the same way.

Policies with roles and teams

If you have multiple G Suite products: With some editions of G Suite, you can apply settings only to your entire organization. For example, with G Suite Basic, setting Drive permissions isn't available for organizational units or groups. Or a feature 

The group settings apply only to members have access to the features or settings. Other members assigned a G Suite Basic license, for example, get the default setting for your organization. 

Setting naming standards

Choose a group naming standard for easier searching, prioritizing, and auditing. For example, use a standard that includes setting name and priority number. The Groups list shows a maximum of 37 characters of a group name. Hovering over a group shows the full name.

Profile_1_all_settings
Profile_2_name
Profile_3_location

If you manage many types of groups, you might add a prefix such as "cf" to indicate a configuration group. Also, use a decimal place to avoid editing your existing group names when you add a configuration group.

cf_Drive_p1.0_SHARE_any
cf_Drive_p2.0_SHARE_trusted
cf_Drive_p2.1_SHARE_trusted_ACCESS_external
cf_Drive_p3.0_SHARE_internal

Creating groups

You must use groups created in the Admin console, Directory API, or Google Cloud Directory Sync. Groups created in Groups for Business can’t be used as configuration groups. (The Admin console doesn’t show whether a group was created in Groups for Business.)

You can manage the configuration group in any tool. You might set strict permissions for adding/deleting users, turn off posting to the group, or prevent users from leaving the group (available only in the Groups API). 

Set up configuration groups

Open all | Close all


Step 1. Apply the configuration group

For this step, you need admin privileges for Groups, Organizational Units (top-level), and Service Settings.​

  1. In the Admin console, go to the settings page for the app. Configuration groups are available for AppMaker, Directory (Profile editing), DriveHangouts Meet, Voice, and YouTube
     
  2. Click the settings you want to edit. For example, here are the YouTube settings for your top-level organization. 

    YouTube settings for organization
     
  3. Click Groups on the left. Any configuration groups are listed in order of priority.

  4. Click Search for a group. The results include all your groups, not only configuration groups.
     
  5. Enter a group address (rather than the name of the group) and then select the group.
     
    • If you don’t find your group, may have been created in Groups for Business. Only groups created in the Admin console, Directory API, or Google Cloud Directory Sync can configure settings.
       
    • Start by adding your configuration groups from highest to lowest priority. When you add new group, it’s placed at the lowest priority.
  6. Choose the settings for your configuration group. By default, a new group has the settings of your top-level organizational unit.  

    YouTube settings for a group
     

    For organizations with multiple types of G Suite licenses: If you have licenses for a G Suite edition that doesn't include a certain setting, you may see a Flag image for multiple licenses next to the settings for a group. This flag appears whether or not the group contains users who don't have the required license.

  7. Turn on or off the configuration group.
     
    • Turn on the group: Click Save.
      The settings are applied to the configuration group’s members. To close the panel, click Cancel
       
    • Turn off the group: Click Unset or click Remove Remove  in the Groups panel (clicking Cancel won't remove the group). 
  8. Adjust the priority of the group by dragging the group up or down. Changes typically take effect in minutes, but can take up to 24 hours.
     
    • To set a group as priority 1: Drag your desired group up to priority 2, then drag the current priority 1 below. You can also enter a number in priority box or click the arrows next to the priority box.
       
    • If you have fewer than 4 groups: you reorder groups containing the same users, those users get the setting of their highest priority group. You may get this alert:

      “More than one policy may be linked to the same users...

      This general alert appears if you add, unset, or change the priority of any configuration group, even if the groups don’t contain the same users.
       
Step 2. Check the settings for a user

For this step, you need admin privileges for Groups, Organizational Units (top-level), and Service Settings.

  1. In the Admin console, go to the settings page for the app. 
  2. In the top left, click Users.
  3. Click Select a user and search for the user’s address (not name).
  4. Select the user to view their settings. Below name of the settingyou can click the configuration group or organization unit that determined the user's settings.

    Profile information

Note: If you check the user's organizational unit, the service setting won't show as Overridden. The settings, Overridden and Inherited, are based only on an organizational unit's setting, not on configuration groups.

Troubleshooting

I don’t see the Groups list

  • The configuration groups feature is available for AppMaker, Directory Profile editing, Drive, Hangouts (Meet settings) and YouTube. Also, configuration groups for Drive aren't available with G Suite Basic or legacy free edition.

I don’t see the configuration group in the Groups list

  • The group may have been created in Groups for Business. Try creating a group in the Admin console.
  • Search for the group's email address rather than the group's name.
  • Try refreshing the setting page. Changes typically take effect in minutes, but can take up to 24 hours.
  • Check that you have admin privileges for Groups.

A user doesn't have the correct service settings

  • Check a user’s group membership. It may take up to 24 hours before the group settings take effect.
  • Find the configuration group that's determining  the user's settings. If the user belongs to multiple configuration groups, you might need to change the group priority or user's group membership.
  • The user may not have the product license for the feature. Some features, such as Shared Drives, are available  only with certain editions of G Suite.
Review changes in the Audit log

The event Application Setting Group Priorities Change logs when you first apply configuration group or change order of priority.

Application Setting Group Priorities Change
For Drive and Docs, group override priorities for Link Sharing 
changed to No Links < Link users < Link anyone

If you change the priority of groups, the event lists the groups in their new order, from lowest to highest priority. Also the event uses the group name rather than the group address. You might want to use a similar naming standard for both your group name and addresses. 

Most other events use a similar format for both organizational units and configuration groups. The prefix, Group Emails (s) identifies a configuration group.

For example, overriding settings with an organizational unit:

Drive Setting Change
PUBLISHING_TO_WEB for Drive changed from INHERIT_FROM_PARENT to PUBLIC 
(OrgUnit Name: { Marketing}

Applying settings with a configuration group:

Drive Setting Change
PUBLISHING_TO_WEB for Drive changed from INHERIT_FROM_PARENT to PUBLIC 
(OrgUnit Name: {example.com}, Group Email(s): Drive_p02_share_external@example.com})

For events with configuration groups, your top-level organizational unit is always listed as the OrgUnit Name.

Was this helpful?
How can we improve it?