![\"ellipsis](\"https://tailscale.com/files/images/icons/fa-ellipsis-h.svg\"){kind=icon}
menu and then select Manage groups.Last validated: Jan 5, 2026
\nThis featureis available for the Standard, Premium, and Enterprise plans.
\nTailscale's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy including the Limited Use requirements.
\nTailscale supports synchronizing Google Workspace users and groups for use in Tailscale access controls.
\nYou need to be an Owner, Admin, or IT admin in Tailscale to complete these steps.
\nWhen you enable Google Sync for the very first time, no users or groups will be added unless you specify\r\ngroups explicitly or select the Sync all users option.
\nBy default, Google Sync only adds users from groups you selected. But if you'd like to mirror all of your Google Workspace users, then you can enable the Sync all users option which will immediately start provisioning users to your tailnet.
\nWhen Sync all users is not enabled, users will be suspended if they are removed from all synced groups. If this is not the desired behavior, enable Sync all users or create an additional Google group that includes all the users to sync. For example, you may have a synced group named all-tailscale-users that contains all users that should have Tailscale access, and then use other groups to manage access control.
By default, a group and its members does not sync into your tailnet unless you explicitly select it.
\nYou need to be an Owner, Admin, or IT admin in Tailscale to complete these steps.
\n menu and then select Manage groups.If a group is renamed in Google Admin Console, the reference does not rename. You will always use the group email to reference the group in your Tailscale access control policies.
\nAfter adding groups and their members to your tailnet, if you want to remove the users whom you previously added using the Sync all users option who are not part of the groups you added, you can use the option Unsync unassigned users.
\nYou need to be an Owner, Admin, or IT admin in Tailscale to complete these steps.
\n menu and then select Unsync unassigned users.Changes to group membership and users within the Google Admin Console are synced to Tailscale every 40 minutes. You can also force a sync to Tailscale.
\nYou need to be an Owner, Admin, or IT admin in Tailscale to complete these steps.
\n menu and then select Force sync.You can refer to a group from Google Workspace in your tailnet policy file file, with a human-readable name. For example:
\n{\r\n \"grants\": [\\\r\n {\\\r\n \"src\": [\"group:admins@example.com\"],\\\r\n \"dst\": [\"*\"],\\\r\n \"ip\": [\"*\"]\\\r\n },\\\r\n {\\\r\n \"src\": [\"group:employees@example.com\"],\\\r\n \"dst\": [\"autogroup:self\"],\\\r\n \"ip\": [\"*\"]\\\r\n },\\\r\n {\\\r\n \"src\": [\"group:engineering@example.com\"],\\\r\n \"dst\": [\"tag:logging\"],\\\r\n \"ip\": [\"*\"]\\\r\n }\\\r\n ]\r\n}\nYou can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.
\nGroups synced from Google Workspace do not replace groups in Tailscale. You can use Google Workspace group sync and also define groups in the tailnet policy file.
\nYou need to be an Owner, Admin, or IT admin in Tailscale to complete these steps.
\n menu and then select Disable.Ask AI
\nreCAPTCHA
\nRecaptcha requires verification.
\nprotected by reCAPTCHA
\n"}![\"Project](\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\")