Administrative Privileges and Roles in G Suite

In G Suite, every instance needs someone who can manage different tools and levels of access. Therefore, each G Suite instance needs at least one account with Super Administrator privileges. The Super Administrator has full administrative authority for everything in the G Suite setup. Because of this, people with Super Administrator privileges should take care to secure access to this account (e.g., use a strong password and require two-step authentication for access).

Additionally, while one Super Administrator is necessary, we recommend at least two people have this level of access. At a small nonprofit organization, this may mean that one staff person and one board member have Super Administrator access. In a large organization, this level of access would typically be restricted to trusted system administrators in different locations.

Pre-built Roles

Google offers several pre-built Administrative roles, each of which provides some level of access to your organization’s Admin console.

Three commonly used pre-built roles include:

• Help Desk Admin, who can reset passwords, as well as view user profiles and the organizational unit structure.

• Groups Admin, who can manage all tasks for your organization’s Google Groups, including the ability to create, delete and manage membership of Groups

• User Management Admin, who can manage all tasks related to non-administrative users. This includes the ability to create and delete user accounts.

Two less frequently used roles are those of a Services Admin and Reseller Admin. The Service Admin can manage services and settings for Google Suite, G Suite Marketplace, and other Google Services. A Service Admin may also manage mobile and Chrome devices. The Reseller Admin is used in circumstances where an organization resells G Suite.

Assign and Configure Roles

Only a Super Administrator may assign administrative roles. Multiple roles may be assigned to an account. A person’s account might be assigned both a Help Desk Admin and Groups Admin role, for example.

Admin roles may be restricted to a specific organizational unit. A person might be given the User Management Admin role, but only for people within their organizational unit. Often, the pre-built roles are sufficient. But in cases where they’re not, a Super Admin may create a custom admin role. Customizable privileges include access to many administrative settings in the Admin console, including user management, groups, the Google Suite account, reports, security, support, services, Chrome and more.

Custom admin roles for both Reports and Support may be helpful. The Reports privilege enables a person to access account usage information, audit logs, and search email logs. This may be useful for various legal or regulatory compliance purposes. The Support privilege gives a person the information needed to contact Google enterprise support. Learn more from Google about how to “Assign administrator roles to a user”.

Google Groups

A Google Group simplifies communication and information sharing among a set of people. The most common Group is an email group. (Other types of groups include a web forum, a Q&A forum, or a collaborative inbox.)

A group administrator adds or removes a member to a group with each member’s email address. Notably, a group may include members outside the organization.

Each Google Group has a unique email address, which is used to share information with the group. Send an email to the group email address to convey a message to all group members. Share a document — or calendar, or site — to the group email address to provide access to all group members.

If you’re looking to learn even more about organizational units and permissions in Google Apps, check out our recent eBook. With this eBook, you can work smarter, not harder. The guide offers tips on how to delegate permissions to users, control access, improve efficiency, and simplify time-consuming tasks. Download it today and boost your productivity!