Configure G Suite service settings with groups

You can apply G Suite service settings to a group of users rather than an entire organizational unit. This lets you control settings for specific users without changing your organizational structure.

Currently, you can use groups to configure settings only for:

Use organizational units to configure all other services settings (such as POP/IMAP settings for Gmail).

 In this article:

  • Apply service settings with groups
  • Design and plan
  • Set up configuration groups
  • Check settings and audit logs
  • Troubleshooting

Apply service settings with groups

With configuration groups, you can apply service settings to a group of users. For example, allow your Marketing team publish videos to YouTube or a group of developers use AppMaker.  Groups can include users from any organization in your account.

How configuration groups work

  • Currently, you can apply configuration groups to settings to AppMaker, Directory (Profile editing settings), and YouTube.

  • Configuration groups can contain users from any organizational unit and other groups (nested groups).

  • A user’s group settings always override their organizational unit's settings.

  • Users can belong to multiple configuration groups. You set the priority of configuration groups, and users get the setting of the highest priority group they belong to.

  • Requirements
    • Configuration groups must be created in Admin console, Google Cloud Directory Sync, or Directory API. Then you can edit the groups in those tools or Google Groups for Business.
    • You can apply service settings and priorities to configuration groups only in the Admin Console.

Design and plan

Before you create configuration groups, you'll typically map your user groups to their settings. For example, these groups can edit certain information in their Directory profile

       
User groups Edit photo  Edit location Edit name
Sales leads
Sales operations  
Sales retailers    

 

Next, you can create the configuration groups based on your user groups or user settings, or a combination that fits your organization.

Option 1: Create configuration groups based on user groups 

Use your existing user groups as configuration groups. Then choose the settings for each configuration group.

 

 

You can finely adjust settings for each group. However, you typically have more configuration groups to manage in the Admin console.

Option 2: Create configuration groups based on user settings

Build configuration groups for different levels of settings. For example, create a configuration group that allows editing of names and another configuration group that allows editing of names and locations. Then, add your user groups as members of the configuration groups. 

 

 

With this option, a  configuration group acts as a container for settings, and you have typically fewer configuration groups to manage in the Admin console. You can use the Groups API to add your user groups to a configuration group.  

Setting priority for configuration groups

When a user belongs to multiple configuration groups, you set which configuration group has priority in determining the user’s setting.

In the Admin console, groups are listed from highest to lowest priority. The user gets the settings of the highest priority group they belong to.

You change the priority of configuration group by moving the group up or down in the Groups list. Setting priority order is available only in the Admin console and not any of the APIs.



For example, with the configuration groups in this priority order, the Sales managers can edit their name and location in their Profiles.

 

 

In this order, the Sales managers can edit only their location and Regional sales can edit their name and location.

 

 

Also, settings aren’t added across groups. In this example, the Sales manager, belongs to 3 groups but gets the settings only of her highest priority group. She can edit her name and photo, not her location.  

 

 

As you plan your groups, you might consider placing the group that applies to the fewest people as the highest priority. 

 

 

Set up configuration groups

Open all   |   Close all

Step 1. Create a configuration group
  1. Create a group or use an existing group.
    You must create the group in the Admin console, Directory API, or Google Cloud Directory Sync. Groups created in Groups for Business can’t be used as access groups. (The Admin console doesn’t show whether a group was created in Groups for Business.)

    Tips:
    • Create a new group dedicated to managing settings.

    • Use a naming standard for easier searching and sorting. For example, use a prefix that include the setting name and priority number. For example: Profile_1_all_settings, Profile_2_name, Profile_3_location.   

  2. Add users or other groups, and set group permissions in either the Admin console, Groups for Business, or Groups API. For example, you may want to turn off posting to the group, add a group owner, or prevent users from leaving a group (available only in the Groups API).

Step 2. Apply the configuration group

For this step, you need admin privileges for Groups, Organizational Units (top-level), and Service Settings.​

  1. In the Admin console, go to the settings page for the app. Configuration groups are available for AppMaker, YouTube, and Directory Profile settings.
  2. Click Groups on the left. You'll see any configuration groups listed in order of priority.


     
  3. Click Search for a group. You’ll see the list of all groups, including configuration groups.
  4. Enter the group address (not the group name), and then select the group.
    Tips:
    • Start by adding your configuration groups from highest to lowest priority. When you add new group, it’s placed at the lowest priority.
    • If you don’t find your group, it may have been created in Groups for Business. Only groups created in the Admin console, Directory API, or Google Cloud Directory Sync can configure settings.
  5. Choose the settings for your configuration group. By default, a new group has the settings of your top-level organizational unit, and the lowest priority. After you save your group, you can change its priority.
  6. Turn on the configuration group.
    • Click Save turn on the configuration group. This applies the settings to the configuration group’s members (both users and groups). In the upper left, the service setting shows as “Locally applied.” The group settings typically take effect in minutes, but can take up to 24 hours.
    • Or, if you don’t want to apply the configuration group, click Remove Removenext to the group name in the Groups panel.
  7. Adjust the priority of the group by dragging the group up or down.
    • ​To set a group as priority 1: Drag your desired group up to priority 2, then drag the current priority 1 below. You can also type a number in priority box or click the arrows next to the priority box.
    • If you have fewer than 4 groups: When you reorder configuration groups that contain the same users, those users get the setting of their highest priority group. You'll see this alert:   

            “More than one policy may be linked to the same users...

      This a general alert that also appears if you add, unset, or change the priority of any configuration group, even if the groups don’t contain the same users.

Changes typically take effect in minutes, but can take up to 24 hours. 

Step 3. Check the settings for a user

For this step, you need admin privileges for Groups, Organizational Units (top-level), and Service Settings.

  1. In the Admin console, go to the settings page for the app. Configuration groups are available for AppMaker, YouTube, and Directory Profile settings.
  2. Click Groups on the left. You'll see any configuration groups listed in order of priority.
  3. In the top left, click Users.
  4. Click Select a user and enter the user’s address (not name).
  5. Select the user to view their settings. Below name of the settingyou can click the configuration group or organization unit that determined the user's settings.

    Profile information

Note: If you check the user's organizational unit, the service setting won't show as Overridden. The settings, Overridden and Inherited,  are based only on an organizational unit's setting, not on configuration groups.

Troubleshooting

I can't deselect a group in the Groups list. My only option is to save the group.

  • In the Groups panel, click Remove Removenext to the group name (this won't delete the group). 

I don’t see the configuration group in the Groups list

  • The group may have been created in Groups for Business. You can only use configuration groups created in the Admin console, Directory API, or Google Cloud Directory Sync.
  • Search for the group name rather than the group address. 
  • Try refreshing the settings page. Changes typically take effect in minutes, but can take up to 24 hours.
  • Check that you have admin privileges for Groups.

A user doesn't have the correct service settings

  • Check a user’s group membership. The user may need to wait up to 24 hours before the access group settings take effect.
  • If the user belongs to multiple configuration groups and you may need to adjust the group priority or user's membership. See Check the settings for a user to view the configuration group that's determining the user's settings.
Review changes in the Audit logs

The Admin audit log records these changes made to configuration groups: 

Event name Action in Admin console
Application Setting Creation Applied a configuration group
Application Setting Deletion Unset a configuration group
Application Setting Change Edited service settings for a configuration group  
Application Setting Group
Priorities Change
Changed the order of configurations groups

 

For example, if you applied the group, profile-name@solarmora.com, the log shows this event: 

Application Setting Creation
For Directory settings, Profile editing allows users to edit their profile information. Editable profile fields created with value [field_type: NAME], [field_type: LOCATION] (OrgUnit Name: {Top-level org}}, Group Email(s): {profile-name@solarmora.com})

Field_type is the service setting, and Group Emails (s): the name of the configuration group. 

If you change the priority of groups, the log shows the groups in their new order, from lowest to highest priority:

Application Setting Group Priorities Change
For Directory settings, group override priorities for Profile editing changed to
Profile_Name  > Profile_Name_Location > Profile_All_Settings. 

 

Was this helpful?
How can we improve it?