Render [environment groups](https://docs.render.com/configure-environment-variables#environment-groups) are a handy tool for sharing config across multiple services: you create a group, define some environment variables in it (like, say, a `REDIS_URL` and an `API_KEY`), then link that group to any number of different services. Whenever you edit the group, Render updates the config for each linked service automatically.

Now, environment groups are even more handy (and secure) thanks to integration with your team's Render [projects](https://docs.render.com/projects). **You can now restrict an environment group to a _single environment_ within one of your team's projects.** This means that _only_ services in that environment can receive the config from that group:

```mermaid
flowchart LR
  subgraph Staging;
    direction LR;
    webservice2(Web Service);
    priv2(Private Service);
  end;
  subgraph Production;
    envgroup[["Environment<br/>Group"]];
    webservice(Web Service);
    priv(Private Service);
    envgroup-->|"✅"|webservice;
    envgroup-->|"✅"|priv;
  end;  
  envgroup -.->|"❌"|Staging;
  class webservice,priv success;
  class webservice2,priv2 failure;
```

By restricting an environment group like this, you remove the possibility of accidentally providing your production database URL to a staging service, or vice versa. One less thing to worry about!

## Setup

To move an environment group to a project environment, open that group in the Render Dashboard and click **Manage > Move group**. Select your project and environment, then click **Move env group**:

<video autoplay loop muted controls width="600">
  <source src="https://render.com/images/move-env-group.mp4"/>
</video>

You're all set! The environment group is no longer linkable to any service that _doesn't_ belong to that environment.

A couple items to note:

- You can't restrict an environment group if it's already linked to a service that _isn't_ in the destination environment. You'll need to unlink those services first, or create a duplicate of the group.
- You can always link _unrestricted_ environment groups to _any_ of your services, including services in a project environment.

---

Try setting up environment-specific config for your team! And if you don't yet _have_ a [team](https://docs.render.com/teams), you can still start creating [environment groups](https://docs.render.com/configure-environment-variables#environment-groups) to share config across your services.


New Controls for Shared Service Config

Setup