Search
Clear search
Close search
Google apps
Main menu

    Pre-built administrator roles

    The easiest way to give administrator privileges to another user is to assign pre-built administrator roles. Each role grants one or more privileges that together, allow performing a common business function. For example, one role allows managing user accounts, another role manages groups, and so on. Assign multiple roles to grant all privileges in those roles.

    Assign roles now Create a custom role

    Here's what each role can do:

    Super Admin

    Has access to all features in the Admin console and Admin API, and can manage every aspect of your organization's account. Super administrators also have full access to all users' calendars and event details. When a super administrator role is assigned to a user, those permissions may take up to 2 weeks to propagate.

    Only super administrators can...
    • Set up Billing
    • Create or assign administrator roles
    • Reset administrator passwords
    • Download a list of users
    • Restore deleted users
    • Modify an administrator's settings
    • Perform email log searches
    • Create, read, update, and delete Organization Units
    • Enable or disable contact sharing
    • Use chat to contact Google Cloud support, in addition to phone and email
    At least one user in your account needs to be a super administrator, but we recommend having at least two. That way, if one of you forgets your password the other can reset it for you. Having more than three super administrators, however, limits all your administrators' options for password recovery. For details, Reset your administrator password.

    Groups Admin

    Has full control over Google Groups created in your Admin console. This administrator can perform the following tasks both from the Admin console and via the Admin API:

    • View user profiles and your organizational structure
    • Create new groups in the Admin console
    • Manage members of groups created in the console
    • Manage group access settings
    • Delete groups from the console
    • Only read Organization Units

    User Management Admin

    Can perform all actions on users who aren't administrators. This administrator can perform the following tasks both from the Admin console and via the Admin API:

    • View user profiles and your organizational structure
    • Only read Organization Units
    • Create and delete user accounts *
    • Rename users and change passwords *
    • Manage a user's individual security settings *
    • Perform these other user management tasks *

    * Applies only for users who aren't administrators. This administrator can't assign administrator privileges, reset an administrator's password, or make other changes to an administrator account. Only a super administrator can perform those tasks.

    Help Desk Admin

    Can reset passwords for users who aren't administrators, both in the Admin console and via the Admin API. This administrator can also view user profiles and your organizational structure. This administrator can only read Organization Units.

    Services Admin

    Can manage products, services, and devices that have been added to your Admin console. This administrator can:

    • Turn services On or Off *
    • Change service settings and permissions *
    • Create custom service addresses
    • Manage Chrome and mobile devices listed in your console
    • Only read Organization Units

    * Applies only for products you've added to your account (G Suite services, My Maps Pro, and so on), Marketplace apps, and free Google services like Google+ and Blogger.

    Reseller Admin

    Can administer, provision, and manage resold customers. This administrator has access to:
    • The Reseller console
    • Admin consoles for their customers' domains
    • Reseller-related APIs

    Users who have only the Reseller Admin role bypass the their own organization's Admin console when they sign in. 

    For details, see Granting access to Reseller features

    If these roles don't meet your needs, Create a custom role.

    Was this article helpful?
    How can we improve it?
    Sign in to your account

    Get account-specific help by signing in with your G Suite account email address, or learn how to get started with G Suite.