Set up group sync

Directory Sync does not sync security groups. 

1. Sign in with an administrator account to the Google Admin console.

   If you aren’t using an administrator account, you can’t access the Admin console.

2. Go to Menu  Directory > Directory sync.

   Requires having the Manage Directory Sync Settings privilege.

3. Click the name of your external directory.
4. Click Set up group sync.
5. (Active Directory only) For Base DN, enter the base distinguished name (DN).

   Example: ou=Sales, dc=example, dc=com. In this example, Directory Sync searches for groups and subgroups under the Sales organizational unit.

6. (Azure Active Directory only) Choose an option:
   • To sync all groups in your external directory, select Sync all groups.
   • To sync specified groups, select Sync selected groups and enter the groups separated by a comma. Click Verify to check that the groups exist in your external directory.
7. Click Continue.

1. For Required attributes, confirm or enter the external directory attributes that map to the following group attributes in the Google cloud directory:
   • Group email address (required)
   • Groups display name (required)
   • Group members (required)
   • Group owner (required)
   • Group description

   For supported Azure Active Directory attributes, go to group resource type: Properties.

2. Click Continue.

Important: Once a group is deleted, it cannot be recovered.

You can delete a group in your Google cloud directory if it's not found by the group scope in your external directory. 

To delete groups not found in the external directory:

1. Check the Delete group in Google directory box.

   If you don't want to delete groups, uncheck the box.

2. Click Continue.

You can choose to set the conditions under which a sync is automatically canceled. If the sync exceeds the safeguard limits, the sync is automatically canceled and no groups are deleted. No further syncs will run until you manually enable the sync.

To set a safeguard:

1. For Safeguards, select Set a percentage of groups or Set a total number of groups and enter a percentage or number.
2. Click Simulate Sync.
3. If a safeguard is triggered, you receive a notification from the alert center that gives details about the failed sync. You can also view additional details in the audit log. For more information, go to Use the alert center and Check log events for Directory Sync.