Gripes with Google Groups (latacora.singles)

GAM is awesome for this. We've also had good luck with Google Apps Scripts. The advantage is that it makes it marginally easier to set up credentials: it does so behind the scenes so you never have creds with admin permissions hit disk. The disadvantage is you're now editing an old-ish version of JavaScript in a janky browser editor that saves to some weird bespoke JSON format. You can also use clasp (https://github.com/google/clasp) to edit these files from your favorite editor but now you own a Software Engineering Project.

Here's roughly what that looks like to get all the mentioned info out:

    function getGroups(domain) {
       var groups = [], pageToken, page;
       do {
           page = AdminDirectory.Groups.list({
               domain: domain,
               maxResults: 100,
               pageToken: pageToken
           });
    
           if (page.groups && page.groups.length > 0) {
               groups = groups.concat(page.groups);
           }
           pageToken = page.nextPageToken;
    
       } while (pageToken);
       return groups;
    }
    
    function getGroupPerms(groups) {
     var perms = [];
     for (var i = 0; i < groups.length; i++) {
       perms.push(AdminGroupsSettings.Groups.get(groups[i].email));
     }
     return perms;
    }

Disclaimer: I'm the author of the linked blog post.

Does it still provide a list of user access rights for single files and directories on Team Drives?

This stems from the origin of Google Groups as the OP mentioned. It’s definitely not ideal but we are actively working on making groups more suitable for the various enterprise/business scenarios they are being used for.

(I’m a PM @ Google working on some of these efforts)

Thanks for writing this up. I'm a PM working on many of the issues you've raised. Happy to chat via email (jaisen@) or offline as well.

Out of curiosity, are the "example scenarios" things you've actually seen in the wild?

Cool! Can you elaborate on what easier to manage and more secure might look like?

We are about to give up on Groups. It is like a stray dog for google. The filtering is hit of miss with groups. Our internal help desk gets 1-2 google group issues / week from our user-base of 70 employees.

One thing that's sort of wonky (and possibly it's something that just got set up in a weird way by an admin here at some point, I'm not remotely a G Suite expert or admin) is connecting Groups and service accounts, or having a service account for a group. For example having support@example.com be a group, but also having a support@example.com service account.

(Currently we have a support@ service account that sometimes sends automated emails and which forwards incoming things to a group where everyone in the group has been granted "send as support@," since the group side is basically acting as a collab support inbox. I think the whole thing could possibly be a "shared inbox" type group were there just a way to have a service account matching the group email. And of course there may some benefit to it being set up how it is that I'm missing, or a way to do so currently that got overlooked somehow.)

I'm not sure how much this stumbles into the woes of Google accounts in general, but it's really hard to deal with Groups if Gmail isn't your mail address. When I left Gmail, I had to invent a new alias to get subscribed to a group because it affiliated my main address with my Google account and so wouldn't let me subscribe with it. But if I go to Groups and interact with it there, it uses my Gmail address, which I don't think is changeable.

So I have inbox@mydomain which Google knows is affiliated with my Google account, google@mydomain which had to be subscribed to the list for me to get mail at my actual email address, and my Gmail address, which Groups uses when I post from the web UI.

Help.

Sidebar: I don't say a ton of nice things about Google, but absolute kudos for you just dropping in here and asking for feedback. Gold star, I'd really like to see more of this.

Google Groups is the pain point of using GSuite. It's not HIPAA compliant, so only about a third of the company can use groups and everyone else uses workarounds. Security controls as mentioned in the article. Really I just want aliases, not aliases and forums combined into one thing. Glad to hear that Groups is being worked on. I've been seriously considering switching to office 365 primarily because of groups

  service_requests@ (group)
    -> operations@ (group)
        -> user1@
    -> eng-support@ (group)
        -> user2@