How can I audit a Google Group’s access before converting it to a Dynamic Group?
Asked by
MellowPine47
I'm planning to convert a static Google Group into a Dynamic Group and want to avoid breaking anything that currently uses the group's email address. Before making the change, I need to identify every Shared Drive, Calendar, file, application, or other resource where the group is listed for access. What's the most reliable audit workflow? Is there a standard Admin Console report, GAM command, or API-based method? Also, if the address stays the same, are the existing permissions preserved automatically, or can the conversion change how those shares work?
Answers
Treat this as an access audit rather than something stored on the Group itself. Search for the group’s exact email address in Shared Drive membership, Drive file permissions, Calendar sharing, and any third-party or internal applications that use group-based authorization. The Admin Console can help with some reporting, but an API or GAM-based inventory is usually needed for a complete review.
Reply to this answer
Pay special attention to Shared Drives and Calendars before converting it. Record the group’s current role on each resource, export the results, and test with a small pilot if possible. Don’t assume that keeping the same email address guarantees identical behavior—the resource ACLs and the new group’s effective membership still need to be verified after the change.
AmberQuill5: That makes sense. I’d compare the before-and-after membership and permissions, then confirm that expected users can still access the drives and calendars once the dynamic rules are active.
Reply to this answer
Add your answer
Answers are reviewed before publication.
VioletCanoe28: So there isn’t one universal Admin Console page that lists every resource? I should check each service separately and use GAM or the APIs for anything the console doesn’t expose.