diff --git a/server/cmd/main.go b/server/cmd/main.go
index 95abcbc..d6e432a 100644
--- a/server/cmd/main.go
+++ b/server/cmd/main.go
@@ -90,6 +90,7 @@ func main() {
 		admin.GET("/group/get/:id", groupHandler.GetById)
 		admin.POST("/group/add", groupHandler.Add)
 		admin.POST("/group/update", groupHandler.Update)
+		admin.POST("/group/switch/:id", groupHandler.Switch)
 		admin.GET("/group/options", groupHandler.Options)
 
 		// profile management
diff --git a/server/internal/handler/config_api.go b/server/internal/handler/config_api.go
index f70ca2d..7a383a5 100644
--- a/server/internal/handler/config_api.go
+++ b/server/internal/handler/config_api.go
@@ -53,6 +53,16 @@ func (h *ConfigApiHandler) FetchAllConfigs(c *gin.Context) {
 		return
 	}
 
+	// check if app's group is enabled
+	if app.GroupId != nil {
+		var group model.BusinessGroup
+		has, _ := dao.Engine.ID(*app.GroupId).Get(&group)
+		if !has || !group.Enabled {
+			c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: "业务组已禁用"})
+			return
+		}
+	}
+
 	// validate token if app has token configured
 	if app.Token != "" && app.Token != req.Token {
 		c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: "Token 无效"})
diff --git a/server/internal/handler/group.go b/server/internal/handler/group.go
index 592dbe9..1e7df96 100644
--- a/server/internal/handler/group.go
+++ b/server/internal/handler/group.go
@@ -124,6 +124,30 @@ func (h *GroupHandler) Update(c *gin.Context) {
 	c.JSON(http.StatusOK, model.WrapperResponse{Code: 0})
 }
 
+func (h *GroupHandler) Switch(c *gin.Context) {
+	id, _ := strconv.Atoi(c.Param("id"))
+	userInfo := middleware.GetUserInfo(c)
+	if !userInfo.IsSuperAdmin() {
+		c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: "超级管理员才能操作"})
+		return
+	}
+
+	var group model.BusinessGroup
+	has, _ := dao.Engine.ID(id).Get(&group)
+	if !has {
+		c.JSON(http.StatusOK, model.WrapperResponse{Code: 404, Msg: "业务组不存在"})
+		return
+	}
+
+	group.Enabled = !group.Enabled
+	now := time.Now()
+	group.UpdatedAt = &now
+	group.UpdatedBy = userInfo.Name
+	dao.Engine.ID(group.Id).Cols("enabled", "updated_at", "updated_by").Update(&group)
+
+	c.JSON(http.StatusOK, model.WrapperResponse{Code: 0, Data: true})
+}
+
 func (h *GroupHandler) Options(c *gin.Context) {
 	var groups []model.BusinessGroup
 	dao.Engine.Where("enabled = 1").Find(&groups)
diff --git a/server/internal/service/auth.go b/server/internal/service/auth.go
index 3e1314b..4f7fea9 100644
--- a/server/internal/service/auth.go
+++ b/server/internal/service/auth.go
@@ -31,6 +31,15 @@ func (s *AuthService) Login(userName, password string) (string, *model.LoginUser
 		return "", nil, errors.New("用户不存在或已禁用")
 	}
 
+	// 检查业务组是否启用
+	if user.GroupId != nil {
+		var group model.BusinessGroup
+		has, _ := dao.Engine.ID(*user.GroupId).Get(&group)
+		if !has || !group.Enabled {
+			return "", nil, errors.New("所属业务组已禁用")
+		}
+	}
+
 	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
 		return "", nil, errors.New("密码错误")
 	}
@@ -93,6 +102,15 @@ func (s *AuthService) ValidateToken(tokenString string) (*model.LoginUserInfo, e
 		return nil, errors.New("user is disabled")
 	}
 
+	// 检查业务组是否启用
+	if user.GroupId != nil {
+		var group model.BusinessGroup
+		has, _ := dao.Engine.ID(*user.GroupId).Get(&group)
+		if !has || !group.Enabled {
+			return nil, errors.New("group is disabled")
+		}
+	}
+
 	// 检查 token 是否在登出后签发
 	if user.LastLogoutAt != nil {
 		iat := int64(claims["iat"].(float64))
diff --git a/web/src/views/group/GroupList.vue b/web/src/views/group/GroupList.vue
index b1ab394..3ba7857 100644
--- a/web/src/views/group/GroupList.vue
+++ b/web/src/views/group/GroupList.vue
@@ -9,9 +9,9 @@
       <el-table-column prop="name" label="组名称"></el-table-column>
       <el-table-column prop="master" label="负责人"></el-table-column>
       <el-table-column prop="remarks" label="备注"></el-table-column>
-      <el-table-column prop="enabled" label="状态" width="80">
+      <el-table-column prop="enabled" label="状态" width="100">
         <template slot-scope="scope">
-          <el-tag :type="scope.row.enabled ? 'success' : 'info'">{{ scope.row.enabled ? '启用' : '禁用' }}</el-tag>
+          <el-switch v-model="scope.row.enabled" @change="handleSwitch(scope.row)"></el-switch>
         </template>
       </el-table-column>
       <el-table-column label="操作" width="100">
@@ -81,6 +81,13 @@ export default {
         this.users = res.data || []
       } catch (e) {}
     },
+    async handleSwitch(row) {
+      try {
+        await request({ url: `/admin/group/switch/${row.id}`, method: 'post' })
+      } catch (e) {
+        row.enabled = !row.enabled
+      }
+    },
     showAdd() {
       this.dialogTitle = '新建业务组'
       this.form = { name: '', masterUid: null, remarks: '' }