Assign an Admin Role to a Google Workspace User
Grant a user admin privileges.
Some good examples are the billing and support admin roles which are not pre-built, so you have to make them on your own if necessary. There are even more, such as the Google Vault admin role and the Admin Quarantine role.
Click the links below if you’d like to see the specific steps to create one of these admin roles.
Go to the Admin console https://admin.google.com and click the Admin roles icon.
Click Create new role.
Give it a name and description and click CONTINUE.
Select the privileges you want to grant from the list (You can also search for privileges by name) and click CONTINUE.
Here is a description of what each checkbox you can see in the list does:
☐ Organizational Units – lets someone manage your OUs
☐ Read – view OUs
☐ Create – create OUs
☐ Update – edit OUs
☐ Delete – delete OUs
Checking Create, Update, or Delete automatically enables Read.
☐ Users lets someone manage your users. (However, note that only a Super Admin can manage another Super Admin’s settings.)
☐ Read – view users
☐ Create – create users
☐ Update – edit users info
☐ Move users – move users between different OUs
☐ Suspend users – suspend users
☐ Rename users – change users’ names and email addresses
☐ Reset password – reset users’ passwords
☐ Force password change – the ability to force users to change their password on their next login
☐ Add/remove aliases – add and remove email aliases
☐ Delete – delete users
Create automatically enables Read and Update. Both Update and Delete automatically enable Read.
☐ Groups – grants complete control over all groups. Lets someone view your users and OUs, create, edit and delete groups, manage group settings and turn on services by group.
To let someone view the groups a user is a member of but not edit them, give them the Groups > Read API permission in the Admin API privileges section.
Services – automatically enables all checkboxes below and grants full access to all service-related admin settings
☐ Service Settings – enable or disable services and update service settings in the Apps section in the Admin console
Managed Google Play
☐ Manage Google Play store – manage the Android Google Play store
☐ Manage uploading private applications to the managed Google Play store – upload private apps to the Play store
☐ Manage uploading private applications with APKs hosted outside of Google – Play – use .apk files hosted outside of the Play store
☐ Contacts Settings Message – enable the options below related to contacts delegation
☐ Delegates Read – allows someone to use APIs to see a list of everyone a user has delegated their contacts to
☐ Delegates Write – allows someone to use APIs to create or delete contact delegation settings in users’ accounts
☐ Settings – manage account-wide Google Currents admin settings
☐ Batch-add user groups to communities – add users to communities in Currents
☐ Access tools to manage streams, tags, and leaders – moderate content in Currents
☐ Settings – manage account-wide Gmail admin settings
☐ Email Log Search – use the Email Log Search, which shows data related to email delivery across your account
☐ Access Admin Quarantine – manage all admin quarantines, including the default one
☐ Access restricted quarantines – lets someone manage only specific quarantines, defined by group membership
Groups for Business
☐ Groups Service Settings – manage account-wide Groups for Business admin settings
☐ Settings – manage account-wide Directory admin settings
Google Data Studio
☐ Manage Data Studio Settings – manage account-wide Google Data Studio settings
☐ Manage Google Sites – manage account-wide Google Sites admin settings
Shared device settings
☐ Parent privilege for Managing all common device configurations – manage common device settings
☐ Manage all common device configurations – manage common device settings, such as network settings for Chrome devices
Mobile Device Management
☐ Manage Devices and Settings – grant complete control over mobile devices listed in the Admin console, as well as all mobile device-related settings
☐ All Settings – grants complete control over all Google Calendar settings
☐ Buildings and Resources – create, edit and delete resources and access the Room Insights Dashboard
☐ Room Insights – view, set filters, and adjust the date range on the Room Insights Dashboard
☐ Manage – create, edit and delete resources, resource features, and buildings
Drive and Docs
☐ Settings – grants complete control over all Google Drive settings
☐ Docs Templates – manage templates and moderate template submissions
☐ Move any file or folder into shared drives – move files and folders to shared drives
☐ View details of new Google Sites – see the owner of a site, see when it was last updated and request edit access
☐ Manage classic Google sites – view, manage and migrate classic Google Sites to the New Sites
☐ Full access – grant full access to the alert center
☐ View access – grant only view access to the alert center
☐ Manage Jamboard Settings – enable or disable the Jamboard service and manage related settings
Google Chat and Classic Hangouts
☐ Settings (Read and Modify) – grants complete control over all Google Chat settings
☐ Settings – grants full control over all Chrome Management settings
☐ Manage User Settings – manage browser settings
☐ Manage Application Settings – manage settings related to Chrome apps & extensions
☐ Managed Browsers – access to managed browsers settings
☐ View Extensions List Report – view list of all Chrome extensions
☐ View Chrome Versions Report – view info on your users’ Chrome versions
☐ View Chrome Insights Report – view insights related to Chrome
☐ Manage Printers – manage printer usage in Chrome
☐ Manage Chrome OS Devices – manage Chrome OS devices, such as Chromebooks and Chromebox for Meetings
☐ Manage Chrome OS Device Settings – manage Chrome OS device settings
☐ Manage Directory Sync Settings – manage settings related to Directory Sync
☐ Read Directory Sync Settings – view settings related to Directory Sync
☐ Settings – manage Hangouts settings
☐ Admin quality dashboard access – track meeting quality stats
☐ Manage YouTube Settings – grants complete control over all YouTube settings. Allows someone to restrict which videos can be viewed by users in your account.
☐ Manage Meet Settings – grants complete control over all Meet settings
☐ Admin quality dashboard access – track meeting quality stats
Google Cloud Print
☐ Cloud Print Manager – grants complete control over all Cloud Print settings
Google Vault – settings related to Google Vault access and usage
☐ Manage Matters – create, share, close, reopen, edit, delete and restore matters
☐ Manage Holds – view a list of users on hold, create and remove holds
☐ Manage Searches – search and view data; create and delete saved searches
☐ Manage Exports – view, download, and delete exports
☐ Manage Retention Policies – view, create, edit and delete retention rules.
☐ View Retention Policies – view all retention rules.
☐ Manage Audits – view audit logs for matters that were created by or shared with the user. It also allows viewing all hold reports and viewing holds in matters the user can access.
☐ View All Matters – view all matters.
☐ User Security Management – grants complete control over all users’ security settings in the Admin console > Users
☐ Security Settings – grants complete control over all security settings – manage less secure apps, user passwords policies, set up SSO
☐ Support – allows someone to contact Google Workspace support on their own by phone, chat, or email
☐ Domain Settings – grants complete control over all domain and general accounts settings:
-Change the organization name, language, logo, and time zone
-Delete the entire Google Workspace account
-View all billing-related information
-Add and remove domains
-Connect a Google Sites website to your domain
-Update contact information for password recovery
-Control users’ access to new features and products
-Control communication preferences
☐ Reports – grants access to all audit logs and reports showing info related to service usage across all users in your account
Review the admin role and click CREATE ROLE, or click BACK if you missed something.
You’re now viewing the admin role’s page, where you can copy it, edit the info, delete it or view the list of users with this role and click Assign role to grant users this role.
Type the name or email address of one or more users. You can add up to 20 people.
Once a user appears, click to select them.
Once you’ve added everyone, click ASSIGN ROLE.
The user appears under Admins on this admin role’s page.
Grant a user admin privileges.
Remove a user’s admin privileges.
Create custom admin roles that fit your needs.
Create an admin user free of charge, solely for management purposes.
Grant a user access to the Billing settings.
Allow a user to contact Google Workspace support on their own.
Think we could do something better or just want to tell us how happy you are with the site? We would love to hear from you – your feedback is more valuable than you can imagine.
Fill out this form, and we will get back to you.
Are you running into an issue with the site? Maybe you found a broken link, or something else is wrong?
Fill out this form to let us know, and we will address it as soon as possible.
Please make sure to be very specific and add as many details as possible.
Our goal is to run the number one site in the world for you to get help with and learn how to use Google Workspace. This can’t be so if there is any missing information.
If you believe we need to add something, fill out this form, and we will do our best to add any missing content as soon as possible.
You can stay on top of news and updates in Google Workspace and Workspace123 and get special offers by subscribing to our newsletter.