Google Workspace groups: Value 'ALL_OWNERS_CAN_CONTACT' is not valid for field 'Contact owners'

I have this too. I'm guessing one has to create a service request because it smells of product defect..

Hi Henrik. I think the permission groups in the Google Workspace target system are outdated. Or after the upgrade One Identity has changed some mappings or data mappings and it's not working?

But if you try and browse the target system through sync editor and find the corresponding group I'm sure the attribute Contact owners has the value ALL_OWNERS_CAN_CONTACT but there is no corresponding value like that in Identity Manager..

Have you checked if you need to define the value in the column properties -> Value Settings -> Permitted values in the Designer for that column of the GAPGroup table? Might work.

I already tried that and I think that you are not allowed to add more values to the attribute..that would of course be the easy solution..

The value coming from Google is not one of the "permitted" values and the schemas says that we cannot customize the permitted values. So indeed a product defect as you mentioned above.

According to Google, (Groups  |  Admin console  |  Google for Developers) the allowed settings for whoCanContactOwner is defined as follows. So, either the documentation is wrong / not up-to-date or the value are not correct. 

Specifies who can contact the group owner. Possible values are:

• ALL_IN_DOMAIN_CAN_CONTACT
• ALL_MANAGERS_CAN_CONTACT
• ALL_MEMBERS_CAN_CONTACT
• ANYONE_CAN_CONTACT

According to Class Groups | Google.Apis.Groupssettings.v1 (googleapis.dev) the values can be:
ALL_IN_DOMAIN_CAN_CONTACT
ALL_MANAGERS_CAN_CONTACT
ALL_MEMBERS_CAN_CONTACT
ANYONE_CAN_CONTACT
ALL_OWNERS_CAN_CONTACT

We did the upgrade from 8.2 to 9.1 and found no problems at all. Truth is, all our grupos are set to ALL_MEMBERS_CAN_CONTACT for this setting,  which is a value that is present in both versions. 

Currently Google supports the settings that henrik a johansson has mentioned: five values:

But version 9x has no support for ALL_OWNERS_CAN_CONTACT, at least it is not a value in the schema. A quick workaround would be to update the column to a valid value while a fix is prepared, being ALL_MANAGERS_CAN_CONTACT the nearest in privileges imho.

I love APIs that pretend to be versioned (v1) but change during the day. :-)

Yes, it seems that Google added a new permitted value for the property in newer versions of the API.

I suggest contacting support in that matter.