How to Create a Custom Google Workspace Admin Role

Here is a description of what each checkbox you can see in the list does:

☐ Organizational Units – lets someone manage your OUs

     ☐ Read – view OUs

     ☐ Create – create OUs

     ☐ Update – edit OUs

     ☐ Delete – delete OUs

Checking Create, Update, or Delete automatically enables Read.

☐ Users lets someone manage your users. (However, note that only a Super Admin can manage another Super Admin’s settings.)

     ☐ Read – view users

     ☐ Create – create users

     ☐ Update – edit users info

     ☐ Move users – move users between different OUs

     ☐ Suspend users – suspend users 

     ☐ Rename users – change users’ names and email addresses

     ☐ Reset password – reset users’ passwords

     ☐ Force password change – the ability to force users to change their password on their next login

     ☐ Add/remove aliases – add and remove email aliases

     ☐ Delete – delete users

Create automatically enables Read and Update. Both Update and Delete automatically enable Read.

☐ Groups – grants complete control over all groups. Lets someone view your users and OUs, create, edit and delete groups, manage group settings and turn on services by group.

To let someone view the groups a user is a member of but not edit them, give them the Groups > Read API permission in the Admin API privileges section.

Services – automatically enables all checkboxes below and grants full access to all service-related admin settings

☐ Service Settings – enable or disable services and update service settings in the Apps section in the Admin console

Managed Google Play

☐ Manage Google Play store – manage the Android Google Play store

☐ Manage uploading private applications to the managed Google Play store – upload private apps to the Play store

☐ Manage uploading private applications with APKs hosted outside of Google  – Play – use .apk files hosted outside of the Play store

Contacts

☐ Contacts Settings Message – enable the options below related to contacts delegation

☐ Delegates Read – allows someone to use APIs to see a list of everyone a user has delegated their contacts to

☐ Delegates Write – allows someone to use APIs to create or delete contact delegation settings in users’ accounts

Currents 

☐ Settings – manage account-wide Google Currents admin settings

☐ Batch-add user groups to communities – add users to communities in Currents

☐ Access tools to manage streams, tags, and leaders – moderate content in Currents

Gmail 

☐ Settings – manage account-wide Gmail admin settings

☐ Email Log Search – use the Email Log Search, which shows data related to email delivery across your account

☐ Access Admin Quarantine – manage all admin quarantines, including the default one

☐ Access restricted quarantines – lets someone manage only specific quarantines, defined by group membership

Groups for Business 

☐ Groups Service Settings – manage account-wide Groups for Business admin settings

Directory Settings

☐ Settings – manage account-wide Directory admin settings

Google Data Studio

☐ Manage Data Studio Settings – manage account-wide Google Data Studio settings

Sites

☐ Manage Google Sites – manage account-wide Google Sites admin settings

Shared device settings

☐ Parent privilege for Managing all common device configurations – manage common device settings

☐ Manage all common device configurations – manage common device settings, such as network settings for Chrome devices

Mobile Device Management

☐ Manage Devices and Settings – grant complete control over mobile devices listed in the Admin console, as well as all mobile device-related settings

Calendar

☐ All Settings – grants complete control over all Google Calendar settings

☐ Buildings and Resources – create, edit and delete resources and access the Room Insights Dashboard

☐ Room Insights – view, set filters, and adjust the date range on the Room Insights Dashboard

☐ Manage – create, edit and delete resources, resource features, and buildings

Drive and Docs

☐ Settings – grants complete control over all Google Drive settings

☐ Docs Templates – manage templates and moderate template submissions

☐ Move any file or folder into shared drives – move files and folders to shared drives

☐ View details of new Google Sites – see the owner of a site, see when it was last updated and request edit access

☐ Manage classic Google sites – view, manage and migrate classic Google Sites to the New Sites

Alert Center

☐ Full access – grant full access to the alert center

☐ View access – grant only view access to the alert center

Jamboard

☐ Manage Jamboard Settings – enable or disable the Jamboard service and manage related settings

Google Chat and Classic Hangouts

☐ Settings (Read and Modify) –  grants complete control over all Google Chat settings

Chrome Management

☐ Settings – grants full control over all Chrome Management settings

☐ Manage User Settings – manage browser settings

☐ Manage Application Settings – manage settings related to Chrome apps & extensions

☐ Managed Browsers – access to managed browsers settings

☐ View Extensions List Report – view list of all Chrome extensions

☐ View Chrome Versions Report – view info on your users’ Chrome versions

☐ View Chrome Insights Report – view insights related to Chrome 

☐ Manage Printers – manage printer usage in Chrome

☐ Manage Chrome OS Devices – manage Chrome OS devices, such as Chromebooks and Chromebox for Meetings

☐ Manage Chrome OS Device Settings – manage Chrome OS device settings

Directory Sync

☐ Manage Directory Sync Settings – manage settings related to Directory Sync

☐ Read Directory Sync Settings – view settings related to Directory Sync

Google Hangouts

☐ Settings – manage Hangouts settings

☐ Admin quality dashboard access – track meeting quality stats

YouTube

☐ Manage YouTube Settings – grants complete control over all YouTube settings. Allows someone to restrict which videos can be viewed by users in your account.

Google Meet

☐ Manage Meet Settings – grants complete control over all Meet settings

☐ Admin quality dashboard access – track meeting quality stats

Google Cloud Print

☐ Cloud Print Manager – grants complete control over all Cloud Print settings

Google Vault – settings related to Google Vault access and usage

☐ Manage Matters – create, share, close, reopen, edit, delete and restore matters

☐ Manage Holds – view a list of users on hold, create and remove holds

☐ Manage Searches – search and view data; create and delete saved searches

☐ Manage Exports – view, download, and delete exports

☐ Manage Retention Policies – view, create, edit and delete retention rules.

☐ View Retention Policies – view all retention rules.

☐ Manage Audits – view audit logs for matters that were created by or shared with the user. It also allows viewing all hold reports and viewing holds in matters the user can access.

☐ View All Matters – view all matters.

Security

☐ User Security Management – grants complete control over all users’ security settings in the Admin console > Users

☐ Security Settings – grants complete control over all security settings – manage less secure apps, user passwords policies, set up SSO

☐ Support – allows someone to contact Google Workspace support on their own by phone, chat, or email

☐ Domain Settings – grants complete control over all domain and general accounts settings:

-Change the organization name, language, logo, and time zone

-Delete the entire Google Workspace account

-View all billing-related information

-Add and remove domains

-Connect a Google Sites website to your domain

-Update contact information for password recovery

-Control users’ access to new features and products

-Control communication preferences

☐ Reports – grants access to all audit logs and reports showing info related to service usage across all users in your account