Google Workspace Dynamic Groups: Setup and Benefits Guide
Dynamic Groups in Google Workspace automatically manage group membership based on predefined rules using user attributes. Key benefits include improved accuracy, enhanced security, and significant time savings for administrators. They ensure up-to-date access control, seamless onboarding/offboarding of users, and efficient targeted communication.
A Dynamic Group in Google Workspace is a type of group where membership is automatically determined based on user attributes. Instead of administrators manually adding or removing members, users are included in the group when their directory information matches defined rules (such as department, job title, or location).
Dynamic Groups are particularly useful for IT and administrative teams because they ensure group membership always stays updated when employee data changes without manual intervention.
Characteristics of a Dynamic Group
A Dynamic Group in Google Workspace has the following characteristics:
- Membership is automatically generated using defined rules
- Users are added or removed automatically when their attributes change
- Rules rely on Google Directory attributes such as department, job title, location, and organizational unit
- Manual membership management is not allowed because the group is entirely rule-based
Which Google Workspace subscriptions provide access to Dynamic Groups?
Dynamic Groups are available in:
- Google Workspace Enterprise Standard
- Google Workspace Enterprise Plus
- Cloud Identity Premium
Requirements
To create and manage Dynamic Groups:
- You must have administrator privileges
- Relevant user attributes must be correctly populated in the Directory
Limitations of Dynamic Groups
Dynamic Groups have some restrictions:
- Only user accounts can be included
- Manual member addition or removal is not possible
- Membership rules rely only on directory attributes, not on user activity or behavior
- Each Google Workspace organization can create up to : 500 Dynamic Groups per customer account
Creating Membership Queries for Dynamic Groups
When creating a Dynamic Group in the Admin Console, define a membership query that determines which users belong to the group.
These queries can be built using:
- Standard attributes provided by Google Directory
- Custom attributes created by administrators
- Or a combination of both
Standard Attributes for Membership Queries:
Google Workspace provides many built-in attributes that can be used when defining membership conditions. Examples include:Account Status Attributes
Custom Attributes:
Custom attributes are additional fields created by administrators to store extra information about users that is not included in the default profile fields.
Automatically Including Users in Dynamic Groups
A user becomes part of a Dynamic Group when their profile attributes match the group’s membership query.
Administrators can update user attributes in two ways:
- Using the Directory API
The Directory API allows administrators or automation systems to update user account data programmatically.
Using the Google Admin Console
Some attributes can also be edited directly from the Users section in the Admin Console
Excluding Users from Dynamic Groups
Dynamic group queries also allow administrators to exclude users who meet certain conditions.
For example:
If a group containing all users who do not live in the United States, would:
- Create a condition where Country Code equals US
- Mark the condition as Exclude
In the query syntax, an exclamation mark (!) indicates exclusion.
Note that for some advanced queries using the exists parameter, the exclusion option may not be supported.
Steps to Create a Dynamic Group
Follow these steps to create a Dynamic Group in the Google Workspace Admin Console:
- Sign in to the Admin Console
- Expand Directory in the left menu
- Select Groups
This opens the Groups management page.
- Create a New Dynamic Group
Click Create Dynamic Group to open the Membership Query builder.
- Select the Attribute Condition
In the Condition dropdown, choose the user attribute that will define group membership.
Examples include:
- Department
- Job title
- Building ID
- Organizational unit
- Choose a Logical Operator
After selecting the attribute, choose a logic operator.
Common operators include:
- Starts With
- Equals
- Equals Ignore Case
The available operators depend on the selected attribute.
For example, using Equals Ignore Case ensures that capitalization differences will not affect the results.
- Enter the Attribute Value
In the Value field, type the attribute value you want to match.
Example:
- Value=test
The query builder will automatically generate a query string based on the selections.
- Preview the Query Results
Click Preview to test the membership query.
This step ensures that:
- The query works correctly
- The expected users are included
A list of matching users will appear below the query builder.
Note: The Create Dynamic Group button remains disabled until the query is successfully previewed.
- Create the Dynamic Group
If the preview results look correct, click Create Dynamic Group.
- Configure Group Details
Provide the required information:
Group Name
Enter a unique name for the group.
Description
Write a brief explanation to identify the purpose of the group.
Group Email Address
Assign a unique email address for the group.
Group email addresses may contain:
- Letters
- Numbers
- Underscores
- Hyphens
- Save the Group
Click Save to finalize the Dynamic Group creation.
Once saved, the group will automatically manage its membership based on the defined query.
Conclusion
Dynamic Groups help organizations simplify user and group management by automating membership updates. This reduces manual work, improves accuracy, and ensures that group membership always reflects current user information in the directory.
