Groups API overview

The Cloud Identity Groups API allows you to create and manage different types of groups, each of which supports different features, as well as their memberships.

Group types

A group is a collection of entities, where each entity can be either another group or a user. The Cloud Identity Groups API supports the following group types:

Google Groups

Google Groups have an email address and are frequently used as mailing lists. Google Groups can also be used across many Google products. For example. you can share a Google Doc with a group, invite a group to a Google Calendar event, or use a group for access management in IAM. A Google Group is the default group type.

Dynamic groups

Dynamic groups are Google Groups whose memberships are automatically managed using a membership query or a query on employee attributes, such as job role or building location. For example, a membership query might be "all users whose job role is Technical Writer in my organization."

Security groups

A security group is similar to a Google Group, but is used specifically for controlling access to organizational resources. A security group is created by updating a Google Group to a security group.

Locked groups

A locked group is a Google Group that administrators have locked to prevent it from getting out of synchronization with an external source, such as an identity provider. Administrators can also lock a Google Group to increase security for sensitive groups. When you lock a Google Group, edits to core attributes and memberships are restricted to a subset of administrators.

While standard group owners, managers, and members can still update settings like message moderation or posting permissions, modifications to the following attributes are limited to authorized administrators. Authorized administrators are typically those with specific roles or conditions like Groups Admin or Groups Editor with a condition that includes locked groups.

POSIX groups (Deprecated)

A POSIX group is a Google Group that is used to manage group membership in LDAP environments. A POSIX group is created by updating a Google Group with POSIX data. The POSIX group data includes a group name and group ID (GID).

POSIX groups are integrated with Google Cloud and are used by VMs in your organization that have OS Login enabled.

Identity-mapped groups