Integration

Temporary Google Workspace group membership

Also searched as Google Groups membership expiration, expiring Google group membership, and temporary access to a Google Workspace group.

Google shipped this properly, and then put it behind three constraints that decide whether you can use it: an edition, an API, and a role.

The three constraints

All three are in Google's own documentation, and any one of them can be the reason this does not apply to you.

• The edition. Google states the feature is available only to Google Workspace Enterprise Standard, Enterprise Plus, Enterprise for Education, and Cloud Identity Premium. Business Standard and Business Plus are not on that list. This is the one that ends the conversation most often, because the tier that has it is usually not the tier a company on Workspace actually bought.
• The API. Expirations are set with the Cloud Identity Groups API's modifyMembershipRoles method, writing an ISO 8601 time into expiryDetail.expireTime. Google documents no Admin console path, which means it is not a thing an administrator does — it is a thing something you built does.
• The role. Only the MEMBER role can carry an expiration. Owners and managers cannot, so the memberships most worth time-bounding are the ones that cannot be.

What it still leaves out

Where it applies, the expiry itself is sound — it is Google removing the member, not a job you run. What it is not is a process:

• No request and no approval. Somebody with rights on the group calls the API. The expiry bounds how long, not whether or on whose say-so.
• No reason attached. Google notifies group owners when memberships are about to expire, which is genuinely useful, and stores nothing about why the access was granted — the field that matters when the question arrives months later.
• Nothing outside Workspace. The person needing a Google group this week usually needs something in Okta, GitHub or AWS in the same request, and each of those has its own mechanism, its own clock and its own way of not firing. The platform wall is the general form of it.

How TemprBac does it

TemprBac holds the expiry itself and calls the Admin SDK Directory API to add and remove members, which means it works on every Workspace edition, on any membership, without the Cloud Identity Premium license and without writing against an API by hand. The same package can carry a Google group alongside Entra ID, Okta, GitHub, AWS IAM and on-premises Active Directory under one end time.

The Google-specific details:

• Groups are addressed by email address (engineering@example.com) and members by their email address, which is the same key the rest of Workspace uses — no separate identifier to map.
• Authentication is a service account with domain-wide delegation impersonating an admin, granted the https://www.googleapis.com/auth/admin.directory.group scope. Only the client_email and private_key are needed out of the downloaded JSON key file, and the private key is stored encrypted.
• Idempotency is symmetric. Adding somebody already in the group is a no-op, and so is removing somebody who is already out. That second case is not hypothetical: an admin who removes a person by hand would otherwise make the scheduled expiry fail and retry five times against a state that was already correct.
• Both list calls are fully paginated. A roster that stops at the first page looks complete, and silently strips approval rights from everyone past the boundary when a group is used to name approvers.
• A 403 fails permanently rather than retrying, because the causes are structural — delegation not granted, or an impersonated admin who cannot administer groups — and the error quotes Google's own explanation rather than replacing it.
• Expiry is checked on a ten-second cycle, and removal is a direct API call rather than a sync. Nothing may block revocation — no plan limit, quota or billing state stops access from expiring.