Groups
Groups, group rules, the Everyone group and temporary membership.
Groups are how you assign apps, scope policies, grant server access and share secrets. Create one in Directory → Groups with a name and description. A group's tabs: People, Applications, Rules and Profile.
Add members with Assign people on the People tab. Each membership shows its source: Manual, Group rule, Access request or Partner. Adding someone by hand makes the membership Manual, even if a rule added them first, so that rule no longer removes them.
Everyone
Everyone is a built-in group that contains every person automatically; you can't add or remove members. Use it to target an app or policy at the whole organization. Partner users are members too, so assign workforce-only apps to a workforce group instead.
Group rules
On a group's Rules tab, Add group rule: if an attribute (Email, Display name or any profile attribute) equals, is one of (comma-separated), starts with, ends with or contains a value, then the person is added to this group.
- Matching is case-insensitive.
- Rules run when a person is created or their profile changes (including over SCIM and just-in-time sign-in), and for everyone when you add a rule.
- When a person stops matching, or a rule is deleted, the memberships it added are removed (unless another rule still matches). Manual and other memberships are never touched by rules.
Example: department equals Engineering keeps the Engineering group in sync with your HR data.
Temporary membership
Memberships can expire. They're created by:
- approved access requests: in Applications → Access Requests → Requestable groups, let people request a group, pick an approver group and a maximum duration (up to 7 days). People ask from Request Access on their dashboard; approvers get an email. Admins can revoke access early;
- partner members with an Access until date.
Expired members are removed automatically within a minute, which also ends access to the group's apps, servers and secrets.