If you have fewer than 50 users, it might be simpler to use only organizational units to Turn a service on or off for Google Workspace users.
As an administrator, you can turn on services for a group of users rather than an entire organizational unit. This action lets you control access for specific users without changing your organizational structure. For example, turn on Google Drive and YouTube for a group of users across your marketing and sales teams. Groups you use in this way, called access groups, can include any users or groups in your account. You can create a group as an access group or, in most cases, use an existing group.
In this article:- Methods of giving users access to services
- How to use access groups
- Set up an access group
- View services for users, groups, and organizational units
- Edit access groups
- Troubleshooting
Methods of giving users access to services
In the Google Admin console, you can turn off an organizational unit’s access to a Google service, such as Google Drive. If some users in that organizational unit need to use Drive, you have 2 options:
- Move the users to an organizational unit that has Drive turned on.
- Create an access group containing members from that one or different organizational units who can access the service, even though their organizational unit has it turned off:
| Organizational units | With an access group |
|---|---|
 |
|
| Google Drive is turned off for organizational units 1 and 2 |
But a group of users within organizational units 1 and 2 can access Google Drive |
How to use access groups
Use access groups only to turn on user access to Google core services, Google additional services, such as YouTube, and SAML applications. You can’t use access groups to turn off user access to a service that’s turned on for their organizational unit. However, if the service is off for their organizational unit but on for their access group, you can turn it off for the group by unsetting it at the group level.
Compared to organizational units
| Access groups | Organizational units | |
|---|---|---|
| Function |
Turn on services. |
|
| Service access | Turn on service for users in the group (but not off). Always overrides the organizational unit's setting. | Turn service on or off for users in the organizational unit. |
| Services supported |
|
|
| User membership | Users from different organizational units can belong to a group. Users can belong to multiple groups. | A user belongs to a single organizational unit. |
| Inheritance | Yes. Groups within a group get access to the service. | Yes. Organizational units can inherit or override the parent organizational unit setting. |
| Automatic user licensing | No | Yes |
Compared to configuration groups
To customize service settings for a group of users in one or multiple organizational units, you can use configuration groups. Here’s how configuration groups differ from access groups:
- Access group—Turn on a service for a group of users, even though it is off for their organizational units.
- Configuration group—Customize service settings (for example, Drive Sharing options) for a group of users that are different from their organizational unit’s settings. The service must be on for the users in the group. For details, see Customize service settings with configuration groups.
The same group can be an access group and a configuration group—that is, you can use it to give users access to a service and customize settings for the service.
Set up an access group
Follow these steps to create and turn on services for an access group.
Step 1. Create the list of users and their organizational unitsIdentify the organizational unit for each user you want to place in the access group. For services included with certain editions, such as Google Vault, check that users have licenses assigned.
Choose your desired service settings for each organizational unit identified above. For example, turn external Calendar sharing on or off or turn off access to specific services. These settings apply for the entire organizational unit. Later, you can turn on service access for your access group.
-
Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
-
From the Admin console Home page, go to Apps.
- Click Google Workspace, Additional Google services, or SAML apps.
- Select the organizational unit for a user in the access group.
- On the right, click the service.
- Choose your settings to the service.
- (Optional) If needed, repeat for the organizational units of the other group members.
- Create a group using the Admin console, Directory API, or Google Cloud Directory Sync. Or use an existing group that was created with one of those tools.
Note: You can’t use a group created with Google Groups, at groups.google.com, or a dynamic group. The Admin console doesn’t show whether a group was created in Google Groups. - Add users or other groups to your access group.
- (Optional) Set permissions for using the group in Google Groups. For example, you might turn off posting to the group or add a group owner. For steps, go to Update group details.
(If you use the Groups Settings API, it has additional settings, such as preventing users from leaving a group.)
For this step, you need admin privileges for Groups, Organizational Units (top-level), and Service Settings. For details, see Administrator privilege definitions.
-
Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
-
From the Admin console Home page, go to Apps.
- Click Google Workspace, Additional Google services, or SAML apps.
- In the Groups section, find and select your group:
- To view the list of access groups, click Search for a group.
- Search by group name or address.
If you don’t find your group, it might be a dynamic group or a group created in Google Groups, neither of which can be access groups.
- On the right, point at the row for the service.
-
To turn on access, click Turn On.
-
To remove access for the group, click Unset. Now, users get the access setting of their organization. However, if the users belong to any other access group with the service turned on, they continue to have access to the service.
-
To set multiple services, check the box for each service and, at the top right, click Unset or On.
-
Changes typically take effect in minutes but can take up to 24 hours to propagate to all users.
In the Admin console, you have 2 ways to find which services are turned on for an access group:
- Review the services enabled for a user and then check that user’s group memberships.
- Go to the service you want and then see the status of that service for the group.
Check a user in the group
View the access groups for a service
-
Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
-
From the Admin console Home page, go to Apps.
- Click Google Workspace, Additional Google services, or SAML apps.
- At the top left, click All users in this account.
- Find a service with the status of On for some. This status indicates that the service is turned on for an organizational unit or access group.
Note: If you check the service status of a user’s organizational unit, it shows Off if the service is turned off for their organizational unit—even if the service is turned on for the user’s access group. The service statuses (On, Off, On for some) are based only on an organizational unit's setting, not access groups. - Point at On for some and click View details.
- Review the service status for all groups and organizational units.
Tell your users about their new service and share tips, guides, and training.
View services for users, groups, and organizational units
Check services and groups for a userOn this page, go to Step 5: Check service access.
On this page, go to Step 5: Check service access.
-
Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
-
From the Admin console Home page, go to Apps.
- Click Google Workspace or Additional Google services.
-
On the left, select the view.
| View | Actions for the service | Status for the service |
|---|---|---|
| All users in this account |
Turn on for everyone or Turn off for everyone (this unsets all access groups) |
Status is based on groups and organizational units.
|
| Groups |
On or Unset |
|
| Organizational Units |
On or Off |
Status is based only on organizational units.
|
Edit access groups
Turn on or unset a service for an access groupOn this page, go to Step 4: Turn on the service.
-
Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
-
From the Admin console Home page, go to Apps.
- Click Google Workspace, Additional Google services, or SAML apps.
-
On the left, click All users in this account.
-
Point at a service and click More
select Turn Off for everyone or Turn On for everyone.
-
Turn Off for everyone—Unsets access groups (no longer shown as On).
-
Turn On for everyone—No change to access groups settings.
-
When you remove members from or delete an access group, the members no longer have access to services through that group.
Troubleshooting
I don’t see the access group on the Apps page- The group might have been created in Google Groups or be a dynamic group, neither of which you can use as access groups.
- Search for the group address rather than the group name.
- You might be on the pages for Google Workspace Marketplace apps, which access groups do not apply to.
- Try refreshing the Apps page. Changes typically take effect in minutes but can take up to 24 hours.
- Check that you have the Groups admin privilege.
- Check a user’s services and group membership. The user might need to wait up to 24 hours before the access group settings take effect.
- Check that the user has a license assigned for the service.
The service status shows whether service is on or off for the organizational unit. It doesn’t indicate whether the organizational unit contains users in an access group. To check an access group’s services settings, on this page, follow the first 4 steps in Step 4: Turn on the service.
