diff --git a/.changelog/6755.txt b/.changelog/6755.txt
new file mode 100644
index 00000000000..7c461ad2ca7
--- /dev/null
+++ b/.changelog/6755.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+container: fixed unable to update `authenticator_groups_config` on `google_container_cluster`
+```
diff --git a/google/resource_container_cluster.go b/google/resource_container_cluster.go
index a48d766370b..cb79f3fa716 100644
--- a/google/resource_container_cluster.go
+++ b/google/resource_container_cluster.go
@@ -3804,9 +3804,16 @@ func expandContainerClusterAuthenticatorGroupsConfig(configured interface{}) *co
 	}
 
 	config := l[0].(map[string]interface{})
-	return &container.AuthenticatorGroupsConfig{
-		SecurityGroup: config["security_group"].(string),
+	result := &container.AuthenticatorGroupsConfig{}
+	if securityGroup, ok := config["security_group"]; ok {
+		if securityGroup == nil || securityGroup.(string) == "" {
+			result.Enabled = false
+		} else {
+			result.Enabled = true
+			result.SecurityGroup = securityGroup.(string)
+		}
 	}
+	return result
 }
 
 func expandNodePoolDefaults(configured interface{}) *container.NodePoolDefaults {