Assign Google Cloud reseller roles & permissions

Google Cloud reseller roles grant permission to use the Partner Sales Console and manage customers.

Users and groups with certain Google Cloud Billing roles or permissions on your billing accounts are automatically granted a Partner Sales Console role. You can also assign Partner Sales Console roles to users who have custom roles. 

Google Cloud Billing role	Level	Partner Sales Console role (auto-assigned)
Billing Account Administrator	Reseller Google Cloud Billing account	GCP Reseller Administrator
Billing Account Viewer or Billing Accounts Costs Manager	Reseller Google Cloud Billing account	GCP Reseller Viewer
Billing Account User	Billing subaccount	Entitlement Manager
Billing Account Viewer	Billing subaccount	Entitlement Viewer

Partner Sales Console roles and permissions

Open all  |   Close all

GCP Reseller Administrator role

Users with the GCP Reseller Administrator role can manage all Google Cloud resale tasks in the Partner Sales Console.

Permissions in the Partner Sales Console

The permissions are limited to the reseller billing accounts on which the user has the Billing Account Administrator role.

• View a customer's Google Cloud subscriptions (billing subaccounts).
• View all Google Cloud customer accounts and edit account information.
• Place a Google Cloud order (create billing subaccount).
• Manage permissions to a subscription (billing subaccount).
• View a customer's order history. Learn more
• Connect unassigned billing subaccounts to customers. Learn more
• Close subscriptions in the Partner Sales Console. Learn more
• View the Dashboard. Learn more
• View and edit customer accounts that have both Google Cloud and Google Workspace subscriptions, and customer accounts with no subscriptions.

Share the Partner Sales Console Getting Started guide with your Billing Account Administrators

Automatic role assignment

The GCP Reseller Administrator role and Billing Account Administrator roles are linked. Users and groups are automatically granted the GCP Reseller Administrator role if they meet these requirements:

1. A user account at your reseller domain, for example, [e-mail]. Groups can contain external users, but those users aren't granted the GCP Reseller Administrator role.

2. The Billing Account Administrator role on one or more of your reseller billing accounts. Note: Your current Billing Account Administrators can assign the role to users in your organization. Learn how

Tip: Billing Account Administrators can assign the Billing Account Administrator role to users and give them access to Partner Sales Console.

Custom role assignment

For users with a custom role or the Billing Account Administrator role at the Organization level, you assign or remove their GCP Reseller Administrator role in the Partner Sales Console.

Note: A user's permissions on reseller billing accounts are not synced between a custom billing role and the GCP Reseller Administrator role.

User requirements

• The user has an account at your reseller domain, for example, [e-mail].
• The user's custom role has the billing.accounts.get and billing.accounts.update permissions on one or more of your reseller billing accounts.

Assign the GCP Reseller Administrator role

1. Sign in to the Partner Sales Console with your Cloud Identity or Google Workspace super administrator account.
2. At the top, click Menu  Settings .
3. Click Reseller roles.
4. Click the Down arrow to view reseller roles and assignments.
5. To assign the GCP Reseller Administrator role to a user:
   1. Click Add member.
   2. Enter a user or group address in your reseller domain.
   3. Select GCP Reseller Administrator.

4. Click Google Cloud Platform billing accounts. All of the accounts are shown unchecked, regardless of the user or group's permissions set in the Google Cloud console.

5. Select the Google Cloud Billing accounts and click Save. The changes might take a few minutes to appear in the Google Cloud console.

GCP Reseller Viewer role

Users with GCP Reseller Viewer role can view customers and their subscriptions (billing subaccounts).

Permissions in the Partner Sales Console

The permissions are limited to the reseller billing accounts on which the user has the Billing Account Viewer or Billing Account Costs Manager role.

• View a customer's Google Cloud subscriptions (billing subaccounts).
• View customer accounts that have both Google Cloud and Google Workspace subscriptions.
• View customer accounts with no subscriptions.
• View customer metrics and trends in the Dashboard. Learn more
• View the order history for a customer.

Role assignment

Users and groups are automatically granted the GCP Reseller Viewer role if they meet these requirements:

1. An account at your reseller domain, for example, [e-mail] or [e-mail]. External users within a group aren't granted the GCP Reseller Viewer role.

2. The Billing Account Viewer or the Billing Account Costs Manager role on one or more of your reseller Google Cloud Billing accounts. Note: If the roles are assigned at the Organization level, the GCP Reseller Viewer role won't be granted.

Role assignments are synced one-way from the Google Cloud Console to the Partner Sales Console. For example, removing a user from the Billing Account Viewer role from a reseller billing account also removes their GCP Reseller Viewer role.

Learn how to view role assignments in the Partner Sales Console.

Help for Partner Sales Console users

Share instructions to view customers and information the Partner Sales Console:

• View customers and subscriptions
• View the Dashboard

Entitlement Manager role

Entitlement Managers can view customers, set permissions to a billing subaccount, and view some information in the dashboard. 

Permissions in the Partner Sales Console

The permissions are limited to set of billing subaccounts on which the user has the Billing Account Manager role. 

• Manage permissions to a subscription (billing subaccount).
• View a customer's Google Cloud subscriptions (billing subaccounts).
• View customer accounts that have both Google Cloud and Google Workspace subscriptions
• View customer accounts with no subscriptions.
• View some customer metrics and trends in the Dashboard. Learn more
• View the order history for a customer.

Role assignment

Users and groups are automatically granted the Entitlement Manager role if they meet these requirements:

1. An account at your reseller domain, for example, [e-mail] or [e-mail]. External users within a group aren't granted the Entitlement Manager role.

2. The Billing Account Manager role on one or more billing subaccounts. Note: If the roles are assigned at the Organization level, the GCP Reseller Viewer role won't be granted.

Role assignments are synced one-way from the Google Cloud console to the Partner Sales Console. For example, removing a user from the Billing Account Viewer role from a reseller billing account also removes their GCP Reseller Viewer role.

How the consoles work together

• Permissions to reseller billing accounts are synced between the GCP Reseller Administrator and Billing Account Administrator roles. For example, removing a user's GCP Reseller Administrator role from a reseller billing account also removes the user's Billing Account Administrator role.

• Changes to a user's GCP Reseller Administrator role don't affect the user's Billing Account Administrator permissions on their Organization or a billing subaccount.

• To turn off a user's access to the Partner Sales Console but keep their permissions to the Google Cloud console, super administrators can remove only the user's GCP Reseller Administrator role.

Help for users

Recommended articles:

• Getting Started guide
• View customers and subscriptions
• View the Dashboard

Entitlement Viewer role

Entitlement Viewers can view customers and their subscriptions, and some information in the dashboard.

Permissions in the Partner Sales Console

The permissions are limited to the billing subaccounts on which the user has the Billing Account Viewer role.

• View a customer's Google Cloud subscriptions (billing subaccounts).
• View customer accounts that have both Google Cloud and Google Workspace subscriptions
• View customer accounts with no subscriptions.
• View some customer metrics and trends in the Dashboard. Learn more
• View the order history for a customer.

Role assignment

Users and groups are automatically granted the Entitlement Viewer role if they meet these requirements:

1. An account at your reseller domain, for example, [e-mail] or [e-mail]. External users within a group aren't granted the Entitlement Manager role.

2. The Billing Account Viewer or the Billing Account Costs Manager role on one or more billing subaccounts.

Role assignments are synced one-way from the Google Cloud console to the Partner Sales Console. For example, removing a user from the Billing Account Viewer role from a billing subaccount also removes their GCP Reseller Viewer role from the billing subaccount.

How the consoles work together

• Permissions to reseller billing accounts are synced between the GCP Reseller Administrator and Billing Account Administrator roles. For example, removing a user's GCP Reseller Administrator role from a reseller billing account also removes the user's Billing Account Administrator role.

• Changes to a user's GCP Reseller Administrator role don't affect the user's Billing Account Administrator permissions on their Organization or a billing subaccount.

• To turn off a user's access to the Partner Sales Console but keep their permissions to the Google Cloud console, super administrators can remove only the user's GCP Reseller Administrator role.

Help for new Partner Sales Console administrators

Recommended articles:

• Getting Started guide
• View customers and subscriptions
• View the Dashboard

View and manage roles

Open all  |   Close all

View role assignments

1. At the top, click Menu  Settings .
2. Click Reseller roles.
3. Click the Down arrow to view administrators and their permissions on reseller billing accounts.
   
   

Change GCP Reseller Administrator permissions to reseller billing accounts

Changing a user's GCP Reseller Administrator permissions on a reseller billing account also changes their Billing Account Administrator permissions.

1. Sign in to the Partner Sales Console with your Cloud Identity or Google Workspace super administrator account.
2. At the top, click Menu  Settings .
3. Click Reseller roles.
4. Click GCP Reseller Administrator.to view reseller roles and assignments.
5. Next to the user or group, click Edit .
6. Check or uncheck the reseller billing accounts and click Save. The changes might take a few minutes to appear in the Google Cloud console.

Assign the GCP Reseller Administrator to users with custom role

For users or groups with a custom billing role, you add or remove their GCP Reseller Administrator role in the Partner Sales Console.

Note: Permissions to reseller billing accounts are not synced between a custom billing role and the GCP Reseller Administrator role.

Requirement for users

• The user has an account at your reseller domain, for example, [e-mail].
• The user's custom role has the billing.accounts.get and billing.accounts.update permissions on one or more of your reseller Google Cloud Billing accounts.

Assign the GCP Reseller Administrator role

1. Sign in to the Partner Sales Console with your Cloud Identity or Google Workspace super administrator account.
2. At the top, click Menu  Settings .
3. Click Reseller roles.
4. Click the Down arrow to view reseller roles and assignments.
5. To assign the GCP Reseller Administrator role to a user:
   1. Click Add member.
   2. Enter a user or group address in your reseller domain.
   3. Select GCP Reseller Administrator.

4. Click Google Cloud Platform billing accounts. All of accounts are shown unchecked, regardless of the user or group's permissions set in the Google Cloud console.

5. Select the Google Cloud Billing accounts and click Save. The changes might take a few minutes to appear in the Google Cloud console.

Remove only the GCP Reseller Administrator role from a user

Turn off a user's access to the Partner Sales Console without changing their permissions on reseller billing accounts.

1. Sign in to the Partner Sales Console with your Cloud Identity or Google Workspace super administrator account.At the top, click Menu  Settings .
2. Click Reseller roles.
3. Click the Down arrow to view all GCP Reseller Administrators.
4. Next to the user or group, click Edit .
5. Uncheck only the GCP Reseller Administrator box to remove the user's access to the Partner Sales Console.
6. Click Save. The user keeps their Billing Account Administrator or custom role and permissions on reseller billing accounts.

Troubleshooting & FAQ

• The user isn't automatically assigned a GCP reseller role or the Partner Sales Console doesn't show any information

The user might have their Google Cloud Billing role assigned on the organization. Assign the GCP Reseller Administrator role with permissions on one or more of your reseller billing accounts.

• Error message "Logged in user is not authorized..."

The user can sign in to the Partner Sales Console but can't access any features. Check that the user has a Partner Sales Console role and permissions on one or more of your reseller billing accounts or billing subaccounts.

• Error message "Can’t find email address in your Cloud Identity or Google Workspace account"

The user doesn't have an account in your reseller domain. Users outside of your domain can't be assigned the Partner Sales Console role.

• The console doesn't show all of my reseller billing accounts

You might be missing the Billing Account Administrator role on one of your reseller billing accounts. Check with another super administrator in your organization.

Related topics

• Getting started: For new Google Cloud resellers
• Getting started: For current Google Cloud resellers
• Connect customers to billing subaccounts
• Order Google Cloud for a new customer
• Assign roles to a billing subaccount
• Partner Sales Console Cloud feature map
• Partner Sales Console Google Cloud FAQ