4 ms·

I'm a PM at Google working on groups functionality for enterprise customers. We're working on ways to make groups easier to manage and more secure. Happy to an

I'm a PM at Google working on groups functionality for enterprise customers. We're working on ways to make groups easier to manage and more secure. Happy to answer questions related to this post or other gripes you may have with Google Groups.

lvh 8y ago
Cool! Can you elaborate on what easier to manage and more secure might look like?
- jmathai 8y ago
  Easier to manage and more secure fall generally end up falling into the same bucket. We're working on ways to ensure that a group contains the people you expect it to have. Sounds like a no-brainer but this is one of the most common pain points we hear from customers. Secondly, there's a slew of group settings exposed through groups.google.com which are not exposed elsewhere (Admin console, APIs). We're working on improving that which will help users know what a group's settings are across all the groups surfaces (groups.google.com, Admin console, APIs).
  - tracker1 8y ago
    I was going to bring up that I wish that groups was more like MS teams, but that leads me into Google Hangouts (Chat, Meet, Allo, Duo, Messenger, Voice, stray dogs everywhere)... Frankly, I loved Hangouts right after the Google Voice integration happened... then they broke it up and made it horrible... I think you (google) should drop them all, bring back "Google Chat" as one named umbrella, get all of it working in one place/system, and do an "update" that points them all to the new app. Having 147 disconnected apps to communicate outright sucks horribly.
pehaada 8y ago
We are about to give up on Groups. It is like a stray dog for google. The filtering is hit of miss with groups. Our internal help desk gets 1-2 google group issues / week from our user-base of 70 employees.
- jmathai 8y ago
  Feel free to reach out to me via email (jaisen@). I imagine you're hitting the same pain points that many of the customers I've talked to over the last few months are. Hopefully what we're working on will address them and it's not too late. Stray dog is an accurate description. Groups has not received the updates needed for use in enterprises but it's a current focus area for us (for reasons you mentioned).
Glyptodon 8y ago
One thing that's sort of wonky (and possibly it's something that just got set up in a weird way by an admin here at some point, I'm not remotely a G Suite expert or admin) is connecting Groups and service accounts, or having a service account for a group. For example having support@example.com be a group, but also having a support@example.com service account. (Currently we have a support@ service account that sometimes sends automated emails and which forwards incoming things to a group where everyone in the group has been granted "send as support@," since the group side is basically acting as a collab support inbox. I think the whole thing could possibly be a "shared inbox" type group were there just a way to have a service account matching the group email. And of course there may some benefit to it being set up how it is that I'm missing, or a way to do so currently that got overlooked somehow.)
- jmathai 8y ago
  When you say service account are you talking about one of these? https://cloud.google.com/iam/docs/understanding-service-accounts https://cloud.google.com/iam/docs/understanding-service-acco...
  - Glyptodon 8y ago
    I think so? I'll see if I can double check. (My understanding is that it's a kind of psuedo-user account, and that it's being used because there's no "virtual user" to "act as the group" when it comes to automated emails and tasks or something along those lines. I wouldn't be surprised if it's more complicated and they created an actual domain user that belongs to no-one and then give the service account permission to act as it or something along those lines.) Whatever is actually happening isn't supper important though - I think somebody over here just did whatever they thought the minimum effort thing to do was without thinking or looking into it much. I'm fairly certain each group having an admin panel having a page that allows "app passwords" or Oauth2-integrations to be set up for its address/account by the group owner/admins would cover at least 90% whatever we've got going. (And once again, it is completely possible that something like that can already happen and just isn't obvious to anybody over here.)
ocdtrekkie 8y ago
I'm not sure how much this stumbles into the woes of Google accounts in general, but it's really hard to deal with Groups if Gmail isn't your mail address. When I left Gmail, I had to invent a new alias to get subscribed to a group because it affiliated my main address with my Google account and so wouldn't let me subscribe with it. But if I go to Groups and interact with it there, it uses my Gmail address, which I don't think is changeable. So I have inbox@mydomain which Google knows is affiliated with my Google account, google@mydomain which had to be subscribed to the list for me to get mail at my actual email address, and my Gmail address, which Groups uses when I post from the web UI. Help. Sidebar: I don't say a ton of nice things about Google, but absolute kudos for you just dropping in here and asking for feedback. Gold star, I'd really like to see more of this.
- jmathai 8y ago
  So you had a google account @yourdomain.com as a Google (and GMail?) account but later left GMail? Did you delete your Google account or just disassociate it with GMail? I haven’t heard of this but I can see how it could happen depending on the exact state of your @yourdomain.com Google account. Sounds messy though and maybe we can sort it out.
  - ocdtrekkie 8y ago
    My email address at my own domain (now my primary address) is listed as a secondary address on my Google/Gmail account, I believe. Last I checked though, I wasn't able to have Groups send list emails to or from that address though. Using another alias at my domain was a method to bypass that, as it isn't connected to the Google account at all. (But of course, it also means my real email and my Gmail each get a copy of list emails.)
twunde 8y ago
Google Groups is the pain point of using GSuite. It's not HIPAA compliant, so only about a third of the company can use groups and everyone else uses workarounds. Security controls as mentioned in the article. Really I just want aliases, not aliases and forums combined into one thing. Glad to hear that Groups is being worked on. I've been seriously considering switching to office 365 primarily because of groups
- jmathai 8y ago
  Can you expand on what HIPAA compliance you’re looking for? HIPPA compliance is something that’s come up but not something I’ve dove into understanding yet. You can add an alias to a group today but perhaps you’re talking about something else? When looking at enterprise usage, groups aren’t always a mailing list or forum. We are working to decouple a lot of what is baked into a Google Group today.
  - twunde 8y ago
    I'd be fine with just an alias to a group of emails. A use case is that a customer service rep finds out that there is an issues with a patient's data. They can't forward a request to a business operations team to look into the issue or to the engineering support team. Just having an alias for a team that we could email would be a big win
    - tracker1 8y ago
      Agreed... I'd love that as well... to be able to have outside users email dev@mydomain, I had to setup a group, allow posting from the internet, etc... (it took a while for me to figure out, as the permissions are strewn across the gsuite admin, and in a few places in the groups admin, when all I wanted was a distribution list that anyone could send to.
      - jmathai 8y ago
        Even Googlers are perplexed when it comes to what certain group settings do and where you go to change them. We're working on improving that. Do you primarily use groups.google.com, admin.google.com or the AdminSDK APIs?

lvh 8y ago

Cool! Can you elaborate on what easier to manage and more secure might look like?

jmathai 8y ago
Easier to manage and more secure fall generally end up falling into the same bucket. We're working on ways to ensure that a group contains the people you expect it to have. Sounds like a no-brainer but this is one of the most common pain points we hear from customers. Secondly, there's a slew of group settings exposed through groups.google.com which are not exposed elsewhere (Admin console, APIs). We're working on improving that which will help users know what a group's settings are across all the groups surfaces (groups.google.com, Admin console, APIs).
- tracker1 8y ago
  I was going to bring up that I wish that groups was more like MS teams, but that leads me into Google Hangouts (Chat, Meet, Allo, Duo, Messenger, Voice, stray dogs everywhere)... Frankly, I loved Hangouts right after the Google Voice integration happened... then they broke it up and made it horrible... I think you (google) should drop them all, bring back "Google Chat" as one named umbrella, get all of it working in one place/system, and do an "update" that points them all to the new app. Having 147 disconnected apps to communicate outright sucks horribly.

pehaada 8y ago

We are about to give up on Groups. It is like a stray dog for google. The filtering is hit of miss with groups. Our internal help desk gets 1-2 google group issues / week from our user-base of 70 employees.

jmathai 8y ago
Feel free to reach out to me via email (jaisen@). I imagine you're hitting the same pain points that many of the customers I've talked to over the last few months are. Hopefully what we're working on will address them and it's not too late. Stray dog is an accurate description. Groups has not received the updates needed for use in enterprises but it's a current focus area for us (for reasons you mentioned).

Glyptodon 8y ago

One thing that's sort of wonky (and possibly it's something that just got set up in a weird way by an admin here at some point, I'm not remotely a G Suite expert or admin) is connecting Groups and service accounts, or having a service account for a group. For example having support@example.com be a group, but also having a support@example.com service account. (Currently we have a support@ service account that sometimes sends automated emails and which forwards incoming things to a group where everyone in the group has been granted "send as support@," since the group side is basically acting as a collab support inbox. I think the whole thing could possibly be a "shared inbox" type group were there just a way to have a service account matching the group email. And of course there may some benefit to it being set up how it is that I'm missing, or a way to do so currently that got overlooked somehow.)

jmathai 8y ago
When you say service account are you talking about one of these? https://cloud.google.com/iam/docs/understanding-service-accounts https://cloud.google.com/iam/docs/understanding-service-acco...
- Glyptodon 8y ago
  I think so? I'll see if I can double check. (My understanding is that it's a kind of psuedo-user account, and that it's being used because there's no "virtual user" to "act as the group" when it comes to automated emails and tasks or something along those lines. I wouldn't be surprised if it's more complicated and they created an actual domain user that belongs to no-one and then give the service account permission to act as it or something along those lines.) Whatever is actually happening isn't supper important though - I think somebody over here just did whatever they thought the minimum effort thing to do was without thinking or looking into it much. I'm fairly certain each group having an admin panel having a page that allows "app passwords" or Oauth2-integrations to be set up for its address/account by the group owner/admins would cover at least 90% whatever we've got going. (And once again, it is completely possible that something like that can already happen and just isn't obvious to anybody over here.)

ocdtrekkie 8y ago

I'm not sure how much this stumbles into the woes of Google accounts in general, but it's really hard to deal with Groups if Gmail isn't your mail address. When I left Gmail, I had to invent a new alias to get subscribed to a group because it affiliated my main address with my Google account and so wouldn't let me subscribe with it. But if I go to Groups and interact with it there, it uses my Gmail address, which I don't think is changeable. So I have inbox@mydomain which Google knows is affiliated with my Google account, google@mydomain which had to be subscribed to the list for me to get mail at my actual email address, and my Gmail address, which Groups uses when I post from the web UI. Help. Sidebar: I don't say a ton of nice things about Google, but absolute kudos for you just dropping in here and asking for feedback. Gold star, I'd really like to see more of this.

jmathai 8y ago
So you had a google account @yourdomain.com as a Google (and GMail?) account but later left GMail? Did you delete your Google account or just disassociate it with GMail? I haven’t heard of this but I can see how it could happen depending on the exact state of your @yourdomain.com Google account. Sounds messy though and maybe we can sort it out.
- ocdtrekkie 8y ago
  My email address at my own domain (now my primary address) is listed as a secondary address on my Google/Gmail account, I believe. Last I checked though, I wasn't able to have Groups send list emails to or from that address though. Using another alias at my domain was a method to bypass that, as it isn't connected to the Google account at all. (But of course, it also means my real email and my Gmail each get a copy of list emails.)

twunde 8y ago

Google Groups is the pain point of using GSuite. It's not HIPAA compliant, so only about a third of the company can use groups and everyone else uses workarounds. Security controls as mentioned in the article. Really I just want aliases, not aliases and forums combined into one thing. Glad to hear that Groups is being worked on. I've been seriously considering switching to office 365 primarily because of groups

jmathai 8y ago
Can you expand on what HIPAA compliance you’re looking for? HIPPA compliance is something that’s come up but not something I’ve dove into understanding yet. You can add an alias to a group today but perhaps you’re talking about something else? When looking at enterprise usage, groups aren’t always a mailing list or forum. We are working to decouple a lot of what is baked into a Google Group today.
- twunde 8y ago
  I'd be fine with just an alias to a group of emails. A use case is that a customer service rep finds out that there is an issues with a patient's data. They can't forward a request to a business operations team to look into the issue or to the engineering support team. Just having an alias for a team that we could email would be a big win
  - tracker1 8y ago
    Agreed... I'd love that as well... to be able to have outside users email dev@mydomain, I had to setup a group, allow posting from the internet, etc... (it took a while for me to figure out, as the permissions are strewn across the gsuite admin, and in a few places in the groups admin, when all I wanted was a distribution list that anyone could send to.
    - jmathai 8y ago
      Even Googlers are perplexed when it comes to what certain group settings do and where you go to change them. We're working on improving that. Do you primarily use groups.google.com, admin.google.com or the AdminSDK APIs?