diff --git a/.changelog/4746.txt b/.changelog/4746.txt
new file mode 100644
index 00000000000..94088f9dd17
--- /dev/null
+++ b/.changelog/4746.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+cloud_identity: add support for `initial_group_config` to the google_cloud_identity_group resource
+```
diff --git a/google/resource_cloud_identity_group.go b/google/resource_cloud_identity_group.go
index cb9df61414c..832b8d9e014 100644
--- a/google/resource_cloud_identity_group.go
+++ b/google/resource_cloud_identity_group.go
@@ -22,6 +22,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
 
 func resourceCloudIdentityGroup() *schema.Resource {
@@ -112,6 +113,18 @@ Must not be longer than 4,096 characters.`,
 				Optional:    true,
 				Description: `The display name of the Group.`,
 			},
+			"initial_group_config": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice([]string{"INITIAL_GROUP_CONFIG_UNSPECIFIED", "WITH_INITIAL_OWNER", "EMPTY", ""}, false),
+				Description: `The initial configuration options for creating a Group.
+
+See the
+[API reference](https://cloud.google.com/identity/docs/reference/rest/v1beta1/groups/create#initialgroupconfig)
+for possible values. Default value: "EMPTY" Possible values: ["INITIAL_GROUP_CONFIG_UNSPECIFIED", "WITH_INITIAL_OWNER", "EMPTY"]`,
+				Default: "EMPTY",
+			},
 			"create_time": {
 				Type:        schema.TypeString,
 				Computed:    true,
@@ -172,7 +185,7 @@ func resourceCloudIdentityGroupCreate(d *schema.ResourceData, meta interface{})
 		obj["labels"] = labelsProp
 	}
 
-	url, err := replaceVars(d, config, "{{CloudIdentityBasePath}}groups?initialGroupConfig=EMPTY")
+	url, err := replaceVars(d, config, "{{CloudIdentityBasePath}}groups?initialGroupConfig={{initial_group_config}}")
 	if err != nil {
 		return err
 	}
diff --git a/google/resource_cloud_identity_group_generated_test.go b/google/resource_cloud_identity_group_generated_test.go
index 6a118bed78b..2e8d4afb5bf 100644
--- a/google/resource_cloud_identity_group_generated_test.go
+++ b/google/resource_cloud_identity_group_generated_test.go
@@ -41,9 +41,10 @@ func TestAccCloudIdentityGroup_cloudIdentityGroupsBasicExample(t *testing.T) {
 				Config: testAccCloudIdentityGroup_cloudIdentityGroupsBasicExample(context),
 			},
 			{
-				ResourceName:      "google_cloud_identity_group.cloud_identity_group_basic",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_cloud_identity_group.cloud_identity_group_basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_group_config"},
 			},
 		},
 	})
@@ -52,7 +53,8 @@ func TestAccCloudIdentityGroup_cloudIdentityGroupsBasicExample(t *testing.T) {
 func testAccCloudIdentityGroup_cloudIdentityGroupsBasicExample(context map[string]interface{}) string {
 	return Nprintf(`
 resource "google_cloud_identity_group" "cloud_identity_group_basic" {
-  display_name = "tf-test-my-identity-group%{random_suffix}"
+  display_name         = "tf-test-my-identity-group%{random_suffix}"
+  initial_group_config = "WITH_INITIAL_OWNER"
 
   parent = "customers/%{cust_id}"
 
diff --git a/website/docs/r/cloud_identity_group.html.markdown b/website/docs/r/cloud_identity_group.html.markdown
index 97a176005cb..3ffe25e809c 100644
--- a/website/docs/r/cloud_identity_group.html.markdown
+++ b/website/docs/r/cloud_identity_group.html.markdown
@@ -47,7 +47,8 @@ Your account must have the `serviceusage.services.use` permission on the
 
 ```hcl
 resource "google_cloud_identity_group" "cloud_identity_group_basic" {
-  display_name = "my-identity-group"
+  display_name         = "my-identity-group"
+  initial_group_config = "WITH_INITIAL_OWNER"
 
   parent = "customers/A01b123xz"
 
@@ -118,6 +119,15 @@ The `group_key` block supports:
   An extended description to help users determine the purpose of a Group.
   Must not be longer than 4,096 characters.
 
+* `initial_group_config` -
+  (Optional)
+  The initial configuration options for creating a Group.
+  See the
+  [API reference](https://cloud.google.com/identity/docs/reference/rest/v1beta1/groups/create#initialgroupconfig)
+  for possible values.
+  Default value is `EMPTY`.
+  Possible values are `INITIAL_GROUP_CONFIG_UNSPECIFIED`, `WITH_INITIAL_OWNER`, and `EMPTY`.
+
 
 ## Attributes Reference