I'm planning to convert a static Google Group into a Dynamic Group and want to avoid breaking anything that currently uses the group's email address. Before making the change, I need to identify every Shared Drive, Calendar, file, application, or other resource where the group is listed for access. What's the most reliable audit workflow? Is there a standard Admin Console report, GAM command, or API-based method? Also, if the address stays the same, are the existing permissions preserved automatically, or can the conversion change how those shares work?
2 Answers
Pay special attention to Shared Drives and Calendars before converting it. Record the group’s current role on each resource, export the results, and test with a small pilot if possible. Don’t assume that keeping the same email address guarantees identical behavior—the resource ACLs and the new group’s effective membership still need to be verified after the change.
Treat this as an access audit rather than something stored on the Group itself. Search for the group’s exact email address in Shared Drive membership, Drive file permissions, Calendar sharing, and any third-party or internal applications that use group-based authorization. The Admin Console can help with some reporting, but an API or GAM-based inventory is usually needed for a complete review.
So there isn’t one universal Admin Console page that lists every resource? I should check each service separately and use GAM or the APIs for anything the console doesn’t expose.
That makes sense. I’d compare the before-and-after membership and permissions, then confirm that expected users can still access the drives and calendars once the dynamic rules are active.