The ID or URL-encoded path of the group that the service account is created in. Must be a top level group.