How to find every Google Group a user belongs to with GAM

One GAM7 command lists the groups a user was added to. A second lists those groups and the groups they sit inside, which is what decides what the person can actually reach. Here are both.

"Which groups is she in?" has two answers. There are the groups she was added to, and there are the groups those groups sit inside. The second set is the one that decides what she can actually reach: a folder shared with allstaff@ is shared with everyone in every group inside allstaff@.

GAM answers both, with one command each.

The short answer

The groups she was added to, with her role in each:

gam user alice@example.org print groups

Those groups and the groups they belong to:

gam user alice@example.org show grouptree

The documentation calls this "Display a user's groups and their parents as an indented list", and the output nests exactly that way. GAM's own example:

User: testuser1@domain.com, Show maximum of 4 Group Trees
  testgroup1@domain.com: Test Group1 (1/4)
    testgroup@domain.com: Test Group Org

(GAM wiki: Users Group Membership) The indented line is the parent: testgroup1 is itself a member of testgroup, so anything shared with testgroup reaches this user too.

For a file rather than the screen, the same thing in CSV:

gam user alice@example.org print grouptree todrive

The columns carry the chain: User,Group,Name,parents,parents.0.email,parents.0.name, where parents is the number of parents found.

Why the second command matters

Google's reference for the direct list describes the result only as the groups "the given user is a member of", and does not say whether that includes groups reached through another group. (Directory API: groups.list)

Measured on a live Education domain: it does not. With one group nested inside another, print groups returned the inner group alone, and show grouptree returned the inner group with the outer one indented beneath it. If you are answering "what can this person see", the first command is not enough on its own.

The groups she owns

Before someone leaves, the useful subset is the groups they are responsible for:

gam user alice@example.org print groups roles owner

show grouptree takes the same roles option. Removing a user from every group covers what happens to a group whose only owner is taken out of it.

Starting from a group instead of a person

When the question begins with a group rather than someone's name, ask which groups contain it:

gam print groups member grade7teachers@example.org

The documentation describes the option as limiting the list "to groups that contain <EmailItem> as a member", and a group's address is as valid an email item as a person's.

A Cloud Identity command that does not answer this

On an Enterprise edition or Education Plus, GAM can also list groups through Cloud Identity:

gam print cigroups cimember alice@example.org

The requirement is spelled out in the documentation: "The cimember <UserItem> option of gam print cigroups requires a Google Workspace Enterprise Standard, Enterprise Plus, and Enterprise for Education; and Cloud Identity Premium accounts." (GAM wiki: Cloud Identity Groups) Enterprise for Education is the edition Google now calls Education Plus.

Measured on a domain that has that edition, it returned exactly the same direct memberships as print groups and did not include the group reached through another group. It is a second way to ask the first question, not an answer to this one.

Or expand everything at once

If you are going to ask this about a lot of people, export every group with the nested groups expanded into their members and search that instead:

gam print group-members todrive recursive noduplicates

How to export Google Groups and their members with GAM explains that export, and why the unexpanded version is worth keeping too.

Sources

In ORINEX Workspace, every user's page has a Groups panel listing the groups they belong to, with a button to add them to another group and a remove button beside each one. What ORINEX Workspace does.