How access groups work
- Groups turn on user access to core services, Google additional services (such as YouTube), and SAML applications. Groups can’t turn off user access to a service that’s turned on for an organizational unit.
- An access group can contain any users or groups within your account. You can use your existing groups, for example, [email protected] or [email protected].
- Access groups control only whether a service is on for a user. You set the service settings (such as Drive sharing) for a a organization unit or configuration groups (available for some services). Learn more
- You create access groups in the Google Admin console, Google Groups for Businesss, Google Cloud Directory Sync, or Directory API. Groups created in Google Groups and dynamic groups can’t be used as access groups.
Compare groups and organizational units
| GROUPS | ORGANIZATIONAL UNITS | |
|---|---|---|
| Function | Turn on servicesConfigure some service settings | Turn on/off servicesConfigure service settings |
| Service access | Turn service ON for users in the group. Always overrides the organizational unit’s setting. | Turn service ON or OFF for users in the organizational unit. |
| Services supported | Core servicesAdditional Google services (such as YouTube, AdWords)SAML apps | Core servicesAdditional Google servicesSAML appsGoogle Workspace Marketplace appsGoogle services without an individual On/Off control |
| User membership | Users from different organizational units can belong to a group. Users can belong to multiple groups. | A user belongs to a single organizational unit. |
| Inheritance | Yes. Groups within a group get access to the service. | Yes. Organizational units can inherit or override the parent organizational unit setting. |
| Automatic user licensing | No | Yes |
Ref: