Create an admin role for an organizational unit

As your organization’s administrator, you can create a custom administrator role for a specific organizational unit. Users you assign to that role can perform admin tasks for that unit but nowhere else. Admin roles for specific organizational units are especially useful for large organizations that need to delegate admin privileges to users in only one part of the organization. Learn more about admin roles.

Create and assign the role

  1. Create a custom administrator role. Make sure the role has only organization-level privileges.
  2. Click Save.
  3. Click the Admins tab, then click Assign Admins.
  4. Add the user you want to assign to the role, then select the organizational unit to which you want the role to apply.
  5. Click Confirm Assignment.

Include only these privileges

Your custom administrator role can grant only privileges that can be assigned to a specific organizational unit:

  • Users
  • User Security Management
  • Organization Units
  • Google Chrome Management
  • Shared Device Settings

If you use the Google Vault archiving and eDiscovery service, your custom role can also grant any of these privileges:

  • Manage Matters
  • Manage Holds
  • Manage Searches
  • Manage Exports

Add other privileges later

You can later include privileges for this administrator role that can't be assigned to a specific organizational unit:

  1. Remove all users from the admin role.
  2. Add privileges that apply to your entire domain.
  3. Assign users to the role.

The admin role now applies to your entire domain.

Was this helpful?
How can we improve it?