Update chatmember role vs "Chat and Space restrictions" setting in Admin Console

[Fabio Fapilo]

Hello there,
I'm trying to work with the update chatmember role command and I encountered an error I can't explain.

In Google Workspace Admin Console we have some OU with the option "Chat and Space restrictions" enabled. 

In our case, only admins and the gam user account have this option unflagged and can therefore create chatspaces and change user roles.

I found out that if I send this command:

gam user ad...@ourdomain.com update chatmember asadmin spaces/SpaceID role member user us...@ourdomain.com

we get the following response:

Chat Admin:  ad...@ourdomain.com  (asadmin), Chat Space:  spaces/SpaceID, Update 1 Chat Member
  Chat Admin:  ad...@ourdomain.com  (asadmin), Chat Space:  spaces/SpaceID, Chat Member:  spaces/SpaceID/members/us...@ourdomain.com, Update Failed: Internal error encountered.

We also found out that, if we go back to the Admin Console and disable the option "Chat and Space restrictions" for the us...@ourdomain.com (giving all users the option to create chatspaces and change their roles), the role update command goes flawless and without error.

Isn't this behavior wrong? I thought that this should prevent the user from changing the role on his one and create new chatspaces...but the admin should always be able to change the user role. What am I getting wrong?

Thanks in advance

[Ross Scroggs]

It would appear to be a Google Chat API bug; an admin can add and delele members from a chat space with 

the restriction but cannot change member roles.

Ross

----

Ross Scroggs

Ross.S...@gmail.com

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/fb525bf9-e076-488f-a260-121a262e2159n%40googlegroups.com.

[F. Fpl]

Thanks Ross for the quick reply,

That's what I was afraid of.

In Google Workspace I'm like King Midas, but with bugs...everything I touch turns into a bug.

I don't really know how I'm supposed to report it to Google. Is there a way to do it? Does Google respond to this kind of reports?

And, back to the subject, can you help me figure out any workaround? Or am I hopeless at this time?

I.E.: if gam could manage that restriction (and if the API would allow it), I could disable the restriction before changing the user role...eventually re-enabling it after the role change.

Not ideal but...

Thanks for your help!

[Ross Scroggs]

I've submitted an issue to Google: https://issuetracker.google.com/issues/513076577

I don't know of a work-around at the moment other that manually unchecking the restrction, managing the members

and then re-checking the restriction.

Ross

----

Ross Scroggs

Ross.S...@gmail.com

To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/6ec48054-f0b9-4a41-837c-a3d60867ea0an%40googlegroups.com.

[Fapilo]

Thank you Ross.

By the way, I noticed that - while the restriction is in place - you can still downgrade then user permission to member without errors (via GAM or via Admin Console). The bug seems to be present only when upgrading the user from member to manager/owner.

Talking about workarounds, maybe I have an idea…very not ideal but at least it should be manageable via gam, without manual intervention in the Admin Console.

What about a 3 steps approach?

1) momentarily adding the user to a temporary group that doesn’t have the restrictions enabled

2) change the user role to manager

3) remove the user from the temporary group

Il giorno 14 mag 2026, alle ore 17:03, Ross Scroggs <ross.s...@gmail.com> ha scritto:

I've submitted an issue to Google: https://issuetracker.google.com/issues/513076577

You received this message because you are subscribed to a topic in the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/google-apps-manager/UIFgVRaTMQk/unsubscribe.
To unsubscribe from this group and all its topics, send an email to google-apps-man...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/416560EE-8524-4D56-B10F-4A57F52696EB%40gmail.com.

[Ross Scroggs]

Good suggestion; that seems to work, I used a security group.

Ross

----

Ross Scroggs

Ross.S...@gmail.com

To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/73B26AEE-CAF0-41E0-883F-1B05FD5E47BE%40gmail.com.