G Suite - GAM delegate to a group?

[localzuk]

I'm setting up some shared mailboxes, and want to delegate rights to them to a group of users.

 

So, as an example:

 

[email protected]

 

should be delegated to [email protected]

 

The group is maintained via active directory.

 

I don't seem to be able to delegate this way? with GAM I run gam user sharedmailbox to [email protected] and receive the error:

 

ERROR: 400: Delegate user not enabled for Gmail - failedPrecondition.

Is there a way to do this?

[RLR]

I don't think pointing gam at a group for this command will work because it's looking for a specific user. I've just tested this with Gam Advanced 3 so this command will depend on what version of gam you're using but it seems to work:

 

gam print members group [email protected] | gam csv - gam user [email protected] delegate to ~email

 

Alternatively, you could powershell it:

 

 

Get-ADGroupMember -Identity "Group Name" | Get-ADUser -Properties Mail |  Select-Object Mail | Export-CSV -Path C:\location\name.csv -NoTypeInformation

$list = Import-Csv -Path C:\location\name.csv

cd c:\gam
foreach ($entry in $list){        
.\gam user $($entry.mail) delegate to [email protected]    
}

Edited February 4, 2020 by RLR

[localzuk]

That's annoying. It means we can't just update AD groups and leave the sync to do it all for us. We have to run a command every time we update the list of delegated users.

[gh5000]

Could have that gam command running on a schedule. It won't hurt to have the gam command fail if the user is already a delegate.

 

Or you could use this sort of thing to only do the gam command when you know there is a change. https://mcpmag.com/articles/2019/03/07/when-user-added-to-active-directory.aspx?m=1

 

Not fully live nor ideal but surely it suffices?

[gh5000]

Could have that gam command running on a schedule. It won't hurt to have the gam command fail if the user is already a delegate.

 

Or you could use this sort of thing to only do the gam command when you know there is a change. https://mcpmag.com/articles/2019/03/07/when-user-added-to-active-directory.aspx?m=1

 

Not fully live nor ideal but surely it suffices?

Pretty sure I do something with our year group mailboxes and our year group AD groups but I haven't touched it in so long. Presume it still works!

[RLR]

That's annoying. It means we can't just update AD groups and leave the sync to do it all for us. We have to run a command every time we update the list of delegated users.

 

Best to set it up as a scheduled task to run once a day. We have a few daily tasks that run to control a few things like calendars, folders and groups.