Support changes to Groups internal/external classification

[colebriggs-eng]

Groups is introducing stricter enforcement of internal/external classifications in Groups. As part of this, we are adding a suboption underneath the "allow external members" setting. This subsetting controls who can add external members. It can be set to all users or admins only.

We'd like to support setting that in GAM. The Groups settings API will support in sometime between now and May.

[taers232c]

Once we get the API documenation for the new setting it can be added to GAM. Ross ---- Ross Scroggs ***@***.***

…

On Jan 29, 2026, at 1:36 PM, colebriggs-eng ***@***.***> wrote: colebriggs-eng created an issue (GAM-team/GAM#1878) <#1878> Groups is introducing stricter enforcement of internal/external classifications in Groups. As part of this, we are adding a suboption underneath the "allow external members" setting. This subsetting controls who can add external members. It can be set to all users or admins only. We'd like to support setting that in GAM. The Groups settings API will support in sometime between now and May. — Reply to this email directly, view it on GitHub <#1878>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACCTYL7DYJKDJBAPSXQEJ4L4JJ4OTAVCNFSM6AAAAACTLT2DG6VHI2DSMVQWIX3LMV43ASLTON2WKOZTHA3TENZQGAYDANI>. You are receiving this because you are subscribed to this thread.

[jay0lee]

jay0lee/google-api-tracker@ead0b5b#diff-7d7a11e0ff3ca7dd99906e35f6fe89ce2cf4c06abe19e8c584e1b6c9fe22f7c2

the whoCanAddExternalMembers attribute is now available.

[taers232c]

7.40.03

Added option whocanaddexternalmembers only_admins_can_add_external_members|end_users_can_add_external_members to <GroupSettingsAttribute>.
It appears that allowexternalmembers true must be set in the same command.
Added option whocanaddexternalmembers to <GroupFieldName>.
These options are not in general release as of 2026-04-13; experiment.

[taers232c]

###
gam config debug_level 1 update group testgroup whocanaddexternalmembers enduserscanaddexternalmembers
...
connect: (www.googleapis.com, 443)
send: PUT /groups/v1/groups/testgroup%40domain.com?fields=&prettyPrint=true&alt=json HTTP/1.1
          Host: www.googleapis.com
          user-agent: GAM 7.40.03 - https://github.com/GAM-team/GAM / GAM Team <google-apps-manager@googlegroups.com> / Python 3.14.4 final / macOS-26.4.1-arm64-arm-64bit-Mach-O arm64 / (gzip)
          authorization: Bearer *****


send: {"whoCanAddExternalMembers": "END_USERS_CAN_ADD_EXTERNAL_MEMBERS"}
reply: 'HTTP/1.1 400 Bad Request\r\n'
...
ERROR:  JSON: {'error': {'code': 400, 'message': 'Required', 'errors': [{'message': 'Required', 'domain': 'global', 'reason': 'required'}]}}
Group: testgroup@domain.com, Update Failed: Invalid JSON setting

###
gam config debug_level 1 update group testgroup whocanaddexternalmembers enduserscanaddexternalmembers allowexternalmembers true
...
connect: (www.googleapis.com, 443)
send: PUT /groups/v1/groups/testgroup%40domain.com?fields=&prettyPrint=true&alt=json HTTP/1.1
          Host: www.googleapis.com
          user-agent: GAM 7.40.03 - https://github.com/GAM-team/GAM / GAM Team <google-apps-manager@googlegroups.com> / Python 3.14.4 final / macOS-26.4.1-arm64-arm-64bit-Mach-O arm64 / (gzip)
          authorization: Bearer *****

send: {"whoCanAddExternalMembers": "END_USERS_CAN_ADD_EXTERNAL_MEMBERS", "allowExternalMembers": "true"}
reply: 'HTTP/1.1 200 OK\r\n'
...
Group: testgroup@domain.com, Updated

###
gam config debug_level 1 update group testgroup whocanaddexternalmembers onlyadminscanaddexternalmembers allowexternalmembers true
...
connect: (www.googleapis.com, 443)
send: PUT /groups/v1/groups/testgroup%40domain.com?fields=&prettyPrint=true&alt=json HTTP/1.1
          Host: www.googleapis.com
          user-agent: GAM 7.40.03 - https://github.com/GAM-team/GAM / GAM Team <google-apps-manager@googlegroups.com> / Python 3.14.4 final / macOS-26.4.1-arm64-arm-64bit-Mach-O arm64 / (gzip)
          authorization: Bearer *****

send: {"whoCanAddExternalMembers": "ONLY_ADMINS_CAN_ADD_EXTERNAL_MEMBERS", "allowExternalMembers": "true"}
reply: 'HTTP/1.1 200 OK\r\n'
...
Group: testgroup@domain.com, Updated

###
gam config debug_level 1 info group testgroup quick fields allowexternalmembers,whocanaddexternalmembers

connect: (www.googleapis.com, 443)
send: GET /groups/v1/groups/testgroup%40domain.com?fields=allowExternalMembers%2CwhoCanAddExternalMembers&prettyPrint=true&alt=json HTTP/1.1
          Host: www.googleapis.com
          user-agent: GAM 7.40.03 - https://github.com/GAM-team/GAM / GAM Team <google-apps-manager@googlegroups.com> / Python 3.14.4 final / macOS-26.4.1-arm64-arm-64bit-Mach-O arm64 / (gzip)
          authorization: Bearer *****
...
reply: 'HTTP/1.1 400 Bad Request\r\n'
...
ERROR:  JSON: {'error': {'code': 400, 'message': 'Invalid field selection whoCanAddExternalMembers', 'errors': [{'message': 'Invalid field selection whoCanAddExternalMembers', 'domain': 'global', 'reason': 'invalidParameter', 'location': 'fields', 'locat\
ionType': 'parameter'}], 'status': 'INVALID_ARGUMENT'}}
Group: testgroup@domain.com, Show Info Failed: Invalid field selection whoCanAddExternalMembers

[jay0lee]

Looks like the feature is still rolling out. Let's give it awhile.

[jay0lee]

This launched:

https://workspaceupdates.googleblog.com/2026/06/stricter-classifications-for-google-groups-to-enhance-data-security-and-privacy.html

Note in the launch details that there was a last minute change of behavior. If an admin adds external members to a group this groups setting should change to true by itself, it doesn't enforce against admins.

@taers232c assigning this to you in case there's any more work you know of but GAM is now reporting on the setting.

[taers232c]

See: https://workspaceupdates.googleblog.com/2026/06/stricter-classifications-for-google-groups-to-enhance-data-security-and-privacy.html

When an admin attempts to add an external member to an internal group via the Cloud Identity or Admin SDK Directory API, or when they sync data from a third-party identity provider via API, the group settings will be automatically updated to allow admins to add external members.

$ gam select jay info  group testgroup1 fields whocanaddexternalmembers,allowexternalmembers
Group: testgroup1@s.jaylee.us
  Group Settings:
    allowExternalMembers: false
  Members: (2)
    owner: ross@s.jaylee.us (user)
    member: testuser1@s.jaylee.us (user)
  Total Members in Group: 2
$ gam select jay update group testgroup1 add member ross.scroggs@gmail.com                
Group: testgroup1@s.jaylee.us, Add 1 Member
  Group: testgroup1@s.jaylee.us, Member: ross.scroggs@gmail.com, Added: Role: MEMBER
$ gam select jay info  group testgroup1 fields whocanaddexternalmembers,allowexternalmembers
Group: testgroup1@s.jaylee.us
  Group Settings:
    allowExternalMembers: true
    whoCanAddExternalMembers: ONLY_ADMINS_CAN_ADD_EXTERNAL_MEMBERS
  Members: (3)
    member: ross.scroggs@gmail.com (user)
    owner: ross@s.jaylee.us (user)
    member: testuser1@s.jaylee.us (user)
  Total Members in Group: 3

Works as advertised.

[taers232c]

This works.