Easiest way to add user to multiple dynamic groups

[Steve Wolf Jr.]

I'm in a K12 environment and have dynamic groups set up by Building OU, but I have a group of teachers that work in multiple buildings.  What is the easiest way to 

1) get these users in multiple dynamic groups?

2) use GAM to accomplish this task ?

[Aston Wooller]

Are they actually dynamic (you set the criteria in Google Admin for membership)? If so, I don't think you can really manually interact with the members of a dynamic group. Even if you could add the members to the dynamic groups, the dynamic group would sync again and remove them in a matter of minutes.

To specifically tackle the issue of needing manual additions to dynamically generated groups, all staff group membership in my org use this hierarchy:

A parent group:

allstaff-<locationname>-group@

And this contains two child groups that are hidden from the global directory:

allstaff-<locationname>-dynamic-group@

allstaff-<locationname>-manual-group@

The dynamic group is not actually a dynamic group. It's a normal assigned group and I manage that with GAM, based on the buildingId name on their Google account profile which I populate with other scripts. I would use an official dynamic group, but you can't nest dynamic groups within assigned groups. In your case, you could probably just use the orgUnitPath column.

For anyone else that needs to be added to the group, you just put them in the manual-group.

For the GAM part, I schedule a daily Powershell script that goes like this:

#Report on all users that includes the attribute you want to use to sync a group to.

$OutputAll = "C:\GAMX\Reports\Google Dynamic Groups synchronisation\EmailsAll.csv"

gam redirect csv $OutputAll print users primaryEmail id firstname lastname Fullname OU Suspended IncludeInGlobalAddressList location lastlogintime creationtime organizations languages archived suspended

<#

Import a CSV that contains a column with the email address of the 'dynamic' group and a column with the value users have on their profile that will be synced to the group.

In my example, my CSV looks like below. This is matched with regex, so I also have a dynamic group for the whole country which matches on their buildingId attribute not being blank.

group,buildingID
allstaff-city...@example.com,CITY

allstaff-countr...@example.com,(.|\s)*\S(.|\s)*

#>

$syncedGroups = Import-Csv "C:\GAMX\Reports\Google Dynamic Groups synchronisation\Dynamic Groups DONOTDELETE.csv"

ForEach ($group in $syncedGroups) {

<#

the :primaryEmail part points GAM to what column in the csvfile to use as the username of the member. 

Then I matchfield with the OU where the user accounts are so I don't catch generic mailboxes.

Finally, I match the column in the  EmailsAll.csv with the value found in the group CSV.

#>
    $CSV = $OutputAll + ":primaryEmail"
    gam update group $group.group sync members usersonly csvfile $CSV matchfield suspended False matchfield orgUnitPath '(\/User Accounts*)' matchfield locations.0.buildingId $group.buildingID
}

And to remove a group from the global address list so people don't accidentally email the manual or dynamic groups directly instead of the parent group:

gam update group allstaff-<locationname>-dynami...@example.com include_in_global_address_list false