Pre-built administrator roles

The easiest way to give administrator privileges to another user is to assign pre-built administrator roles. Each role grants one or more privileges that together, allow performing a common business function. For example, one role allows managing user accounts, another role manages groups, another role manages calendars and resources, and so on. Assign multiple roles to grant all privileges in those roles.

If these roles don't meet your needs, you can create a custom admin role to assign specific privileges to individual users.

Assign roles now Create a custom role

Here's what each role can do:

	Super Admin Has access to all features in the Admin console and Admin API, and can manage every aspect of your organization's account. Super administrators also have full access to all users' calendars and event details. After you assign the Super Admin role to a user, it can take up to 24 hours for the calendar privileges to be available. Only super administrators can... Set up billing Perform license management Create or assign administrator roles Reset administrator passwords Restore deleted users Modify an administrator's settings Enable or disable contact sharing At least one user in your account needs to be a super administrator, but we recommend having at least two. That way, if one of you forgets your password the other can reset it for you. Having more than three super administrators, however, limits all your administrators' options for password recovery. For details, Reset your administrator password.
	Groups Admin Has full control over Google Groups created in your Admin console. This administrator can perform the following tasks both from the Admin console and via the Admin API: View user profiles and your organizational structure Create new groups in the Admin console Manage members of groups created in the console Manage group access settings Delete groups from the console Only read Organization Units
	User Management Admin Can perform all actions on users who aren't administrators. This administrator can perform the following tasks both from the Admin console and via the Admin API: View user profiles and your organizational structure Only read organizational units Create and delete user accounts * Rename users and change passwords * Manage a user's individual security settings * Perform these other user management tasks * * Applies only for users who aren't administrators. This administrator can't assign administrator privileges, reset an administrator's password, or make other changes to an administrator account. Only a super administrator can perform those tasks.
	Help Desk Admin Can reset passwords for users who aren't administrators, both in the Admin console and via the Admin API. This administrator can also view user profiles and your organizational structure. This administrator can only read Organization Units.
	Services Admin Lets you manage certain service settings and devices that have been added to your Admin console, including for example: Calendar, Drive and Docs, and other services. This administrator can: Turn services On or Off * Change service settings and permissions * Manage Calendar resources Note: Users with the Services admin role can only create, edit, and delete resources. They can’t modify the sharing settings of Calendar resources. Manage Chrome and mobile devices listed in your console Only read Organization Units * Applies only for certain products you've added to your account (G Suite services, Google Voice, and so on), Marketplace apps, and free Google services like Blogger. Some products and services such as Google Vault and Cloud Print do not support the Services admin role.
	Mobile Admin Can manage mobile devices using advanced mobile device management. This administrator can: Provision and approve devices Whitelist apps Block or wipe devices and accounts Set Android and iOS device policies See groups and users in the domain Don’t see this role in your Admin console? This role is available only to customers who signed up for G Suite after February 2018. If you joined before this date, you can create a custom role with the same access.
	Google Voice Admin Can manage all Google Voice settings and provisioning except assign Voice licenses. This administrator can: Add locations Assign numbers to users Port numbers Change service addresses Set up desk phones Set up an auto attendant
	Reseller Admin (applies only to G Suite Authorized Resellers) Can administer, provision, and manage their customers. This administrator has access to: The Reseller console Admin consoles for their customers' domains Reseller-related APIs Users who have only the Reseller Admin role bypass their own organization's Admin console when they sign in.

Was this helpful?

How can we improve it?