Give a Google Workspace administrator the permissions needed for their job. A colleague who resets user passwords or manages groups usually does not need unrestricted control of the organisation. Separate administrative responsibility from ordinary mailbox access and review it during staff changes.
IN THIS ARTICLE
01 Choose the smallest suitable role
- List the tasks the person must perform, such as managing users, groups or a particular service.
- Review Google's predefined administrator roles and the available scope controls. Use a custom role only when the standard roles do not fit and the required privileges are understood.
- With the required administrator privileges, open Directory > Users, select the named user and open Admin roles and privileges.
- Turn on Assigned for the selected role. Where the role supports it, edit All organizational units to restrict the assignment to the intended units.
- Save the assignment. If the organisation requires multi-party approval, complete the displayed approval workflow and confirm that the change has taken effect. Have the person verify the required operation from their own account.
- Check that unrelated sensitive settings are not unnecessarily accessible.
02 Protect recovery access
Maintain an appropriate second authorised recovery route for the organisation. Do not leave every super-administrator account dependent on one person's phone or an inaccessible personal mailbox. Protect privileged accounts with the organisation's strongest supported authentication methods.
How do I verify that a limited Google administrator role is correct?
For example, a helpdesk administrator should be able to perform the approved user-support action without needing to change billing or domain-wide security. If a control is missing, identify the specific required privilege instead of immediately assigning super-administrator access.
03 Remove access cleanly
When a project ends or a staff member changes roles, remove the unnecessary assignment and review active sessions and connected tools. Keep a record of the role, scope, approver and review date.
Administrator permission does not replace your organisation's approval for reading employee data or exporting business records. Use the role to carry out authorised work and share sensitive evidence only with the appropriate people.