Configure G Suite service settings with groups

You can apply G Suite service settings to a group of users rather than an entire organizational unit. This lets you control settings for specific users without changing your organizational structure.

Currently, you can use groups to configure settings only for Directory Profile editing.

Use organizational units to configure settings and all other services (such as POP/IMAP settings for Gmail).

 In this article:

  • Apply G Suite service settings with groups
  • How configuration groups work
  • Design your group policies
  • Set up configuration groups

Apply service settings with groups

In the Admin console, you choose whether users can edit their Profile information, such as their name, photo, an location. With configuration groups, you can apply Profile editing settings to a group of users. For example, allow every executive assistant to edit all of their profile information or let people who travel frequently edit just their location.  Groups can include users from any organization in your account.


How configuration groups work

  • At this time, you can use groups to configure settings for Directory Profile editing.

  • A user’s group settings always override their organizational unit's settings.

  • Configuration groups can contain users from any organizational unit and other groups (nested groups).
  • Users can belong to multiple configuration groups. You set the priority of configuration groups, and users get the setting of the highest priority group they belong to.
  • You must create configuration groups in the Admin console, Google Cloud Directory Sync, or Directory API. Then you can edit the groups in those tools or Google Groups for Business.

Design your configuration groups

Before you create configuration groups, you'll typically map your user groups to their settings. For example, these users should be able to edit certain Directory Profile information.

  Profile setting
User groups edit
Name
edit
Photo
edit
Location
Sales leads
Sales retail  
Sales team    

 

Next, you can create the configuration groups based on your user groups or user settings, or a combination that fits your organization.

Option 1: Create configuration groups based on user groups 

Use your existing user groups as configuration groups. Then choose the settings for each configuration group.

 

 

You can finely adjust settings for each group. However, you typically have more configuration groups to manage in the Admin console.

Option 2: Create configuration groups based on user settings

Build configuration groups for different levels of settings. For example, create a configuration group that allows editing of names and another configuration group that allows editing of names and locations. Then, add your user groups as members of the configuration groups. 

 

 

With this option, a  configuration group acts as a container for settings, and you have typically fewer configuration groups to manage in the Admin console. You can use the Groups API to add your user groups to a configuration group.  

Setting priority for configuration groups

When a user belongs to multiple configuration groups, you set which configuration group has priority in determining the user’s setting.

In the Admin console, groups are listed from highest to lowest priority. The user gets the settings of the highest priority group they belong to.

You change the priority of configuration group by moving the group up or down in the Groups list. (Priority order is available only through the Admin console and not any of the APIs.)



For example, with the configuration groups in this priority order, the Sales managers can edit their name and location in their Profiles.

 

 

In this order, the Sales managers can edit only their location and Regional sales can edit their name and location.

 

 

Also, settings aren’t added across groups. In this example, the Sales manager, belongs to 3 groups but gets the settings only of her highest priority group. She can edit her name and photo, not her location.  

 

 

As you plan your groups, you might consider placing the group that applies to the fewest people as the highest priority. 

 

 

Set up configuration groups

Open all   |   Close all

Step 1. Create a configuration group
  1. Create a group or use an existing group.
    You must create the group in the Admin console, Directory API, or Google Cloud Directory Sync. Groups created in Groups for Business can’t be used as access groups. (The Admin console doesn’t show whether a group was created in Groups for Business.)

    Tips:
    • Create a new group dedicated to managing settings.

    • Use a naming standard for easier searching. For example, add a prefix such as Profile or Prof, to the group name.  

  2. Add users or other groups, and set group permissions in either the Admin console, Groups for Business, or Groups API. For example, you may want to turn off posting to the group, add a group owner, or prevent users from leaving a group (available only in the Groups API).

Step 2. Apply the configuration group

For this step, you need admin privileges for Groups, Organizational Units (top-level), and Service Settings.

 

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Menu Menuand then Directory and then Directory settings.
  3. Click Profile editing.
  4. Click Groups on the left. You''ll see any configuration groups listed in order of priority.


     
  5. Click Search for a group. You’ll see the list of all groups, including configuration groups.
  6. Enter the group name (not the group name), and then select the group.
    Tips:
    • Start by adding your configuration groups from highest to lowest priority. When you add new group, it’s placed at the lowest priority.
    • If you don’t find your group, it may have been created in Groups for Business. Only groups created in the Admin console, Directory API, or Google Cloud Directory Sync can configure settings.
  7. Choose the Profile editing settings for your configuration group. By default, a new group has the Profile editing settings of your top-level organizational unit, and the lowest priority. After you save your group, you can change its priority.
  8. Turn on the configuration group.
    • Click Save turn on the configuration group. This applies the settings to the configuration group’s members (both users and groups). In the upper left, the service setting shows as “Locally applied.” The group settings typically take effect in minutes, but can take up to 24 hours.
    • Or, if you don’t want to apply the configuration group, click Remove Removenext to the group name in the Groups panel.
  9. Adjust the priority of the group by dragging the group up or down.
    • ​To set a group as priority 1: Drag your desired group up to priority 2, then drag the current priority 1 below. You can also type a number in priority box or click the arrows next to the priority box.
    • If you have fewer than 4 groups: When you reorder configuration groups that contain the same users, those users get the setting of their highest priority group. You'll see this alert:   

            “More than one policy may be linked to the same users...

      This a general alert that also appears if you add, unset, or change the priority of any configuration group, even if the groups don’t contain the same users.

Changes typically take effect in minutes, but can take up to 24 hours. 

Step 3. Check the settings for a user

For this step, you need admin privileges for Groups, Organizational Units (top-level), and Service Settings.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Menu Menuand then Directory and then Directory settings.
  3. Click Profile editing.
  4. In the top left, click Users.
  5. Click Select a user and enter the user’s address (not name).
  6. Select the user to view their settings. Below Profile information, you can click the configuration group or organization unit that determined the user's settings.

Profile information

Note: If you check the user's organizational unit, the service setting won't show as Overridden. The settings, Overridden and Inherited,  are based only on an organizational unit's setting, not on configuration groups.

Troubleshooting

I can't deselect a group in the Groups list. My only option is to save the group.

  • In the Groups panel, click Remove Removenext to the group name (this won't delete the group). 

I don’t see the configuration group in the Groups list

  • The group may have been created in Groups for Business. You can only use configuration groups created in the Admin console, Directory API, or Google Cloud Directory Sync.
  • Search for the group name rather than the group address. 
  • Try refreshing the Profile Editing settings page. Changes typically take effect in minutes, but can take up to 24 hours.
  • Check that you have admin privileges for Groups.

A user doesn't have the correct service settings

  • Check a user’s group membership. The user may need to wait up to 24 hours before the access group settings take effect.
  • If the user belongs to multiple configuration groups and you may need to adjust the group priority or user's membership. See Check the settings for a user to view the configuration group that's determining the user's settings.
Review changes in the Audit logs

The Admin audit log records these changes made to configuration groups: 

Event name Action in Admin console
Application Setting Creation Applied a configuration group
Application Setting Deletion Unset a configuration group
Application Setting Change Edited sergice settings for a configuration group  
Application Setting Group
Priorities Change
Changed the order of configurations groups

 

For example, if you applied the group, profile-name@solarmora.com, the log shows this event: 

Application Setting Creation
For Directory settings, Profile editing allows users to edit their profile information. Editable profile fields created with value [field_type: NAME], [field_type: LOCATION] (OrgUnit Name: {Top-level org}}, Group Email(s): {profile-name@solarmora.com})

Field_type is the service setting, and Group Emails (s): the name of the configuration group. 

If you change the priority of groups, the log shows the groups in their new order, from lowest to highest priority:

Application Setting Group Priorities Change
For Directory settings, group override priorities for Profile editing changed to
Profile_Name  > Profile_Name_Location > Profile_All_Settings. 

Was this article helpful?
How can we improve it?