Managing the Google Admin Console can be overwhelming, especially for large organizations or educational institutions. However, not all tasks need to be handled by the Super Admin. Delegating responsibilities to trusted staff members by creating custom admin roles is a smart way to ensure productivity while maintaining control over critical administrative functions. Custom roles allow administrators to distribute specific tasks without compromising security, making it an essential feature for organizations.
At Cloud Sultans, our mission is to help small and large businesses better collaborate and achieve high productivity with their teams by maximizing the power of Google Workspace (formerly GSuite).
📋 System Roles: Predefined by Google, Ready to Use
Google offers several predefined system roles, which are a great starting point. These roles, such as Super Admin, User Management Admin, and Help Desk Admin, come with preset privileges designed to handle different levels of administrative tasks. For example, the User Management Admin role allows users to create, delete, or manage users. On the other hand, the Help Desk Admin role is limited to just resetting passwords, making it a safer option for delegating basic tasks to staff members like the Support Level 1.
These system roles save time by providing essential administrative permissions without requiring any configuration. However, as useful as these predefined roles are, there may be situations where more specialized roles are needed.
🔧 Custom Admin Roles: Admin Defined Role, Fully customizable
While the predefined roles provide a solid foundation, custom admin role offer more flexibility. You can limit access to specific organizational units, such as a middle school within a district, or to a particular feature, like resetting passwords for only that unit. This level of granularity ensures that delegation is done securely, avoiding accidental changes across other parts of the organization.
For instance, you can create a custom role, allowing a member to approve apps and extensions for your organization’s Chromebooks. This role prevents the need for a super admin to handle every minor approval request, ensuring smoother operation and less workload for top-level admins.
You can create a light Admin Role that allows you to Create/Update/Delete Users and reset passwords. Then, name a Manager for each OU.
For example, the Visual Effect Manager will be autonomous to manage all the accounts for a specific Organisation Unit Video Production and the Visual Effect Manager will only manage what is happening in Visual Effect OU. It won’t waste time waiting for the admin to create new users and Super Admin won’t waste time for such time-consuming little tasks.
🛠️ Step-by-Step: How to Create a Custom Admin Role
Creating a custom admin role within Google Workspace is a straightforward process. From the Admin Console, navigate to the Admin Roles section, and start by naming your new role. For clarity, a good practice is to add a description to help other administrators understand the scope of the role. You can select from a wide range of permissions, categorized by function.
1. For example, if you want to set up the Drive Admin role that would search for “Application Settings” and then select the specific Drive Admin permissions to make changes.
2. To create that role, go to Admin Console (admin.google.com) and then click on Accounts > Admin Roles > Select the “Create new role” option.
3. Provide the appropriate name and description for the role and click “Continue”.
4. Now you should be redirected to the following page where admins can see all admin privileges that can be assigned to your new role.
5. Select the appropriate admin privilege as per the requirement. For the Drive Admin Role, we will select all the privileges under Google Drive & Sites and click “Continue”
You can create a role with only Move any file or folder into Shared Drives and assign it to a specific user when then want to migrate a full folder structure into a Share Drive. Very useful when a collaborator is about to leave the company for example.
6. Final review of the new admin role and its associated privileges. Admin can click on the “Create Role” option to create the new custom admin role.
🛠️ How to Assign a Custom Admin Role OR System Role?
Assigning the Admin Role is an essential step to allow the delegated admin access to the Admin Console. For instance, assuming that the admin wanted to assign the Help Desk Admin role to the user then the admin can follow the below guidelines to achieve the requirement.
1. In Admin Console (admin.google.com), go to Accounts > Admin Roles and navigate to the role “Help Desk Admin”.
2. Now click on that Help Desk Admin role name and then you should see the following screen. From this admin role page, select the button named “Assign Role”.
3. Now choose the option named “Assigned members”.
4. The new screen should ask you to provide the user details that will be granted with the admin role. Provide the email address of the user and then select the appropriate user from the dropdown menu.
5. Now you can see that the “Assign Role” button is activated and the admin needs to click on the “Assign Role” option to complete the admin role assignment process.
💡 Helpful Custom Roles to Consider
Custom roles can be designed for various administrative tasks that don’t require full access to the Google Admin Console. Here are a few examples to consider implementing in your organization:
- Reports Access Admin: This role grants access to the reporting section of the Admin Console. Users with this role can view data on storage usage, email traffic, and document creation, but they won’t have access to other settings. This role is particularly helpful for administrators who need data for grant proposals or funding reports.
- Calendar Admin: If your organization uses resource calendars to manage shared assets like laptop carts or conference rooms, delegating calendar management to a trusted user ensures efficient handling of reservations. This role allows users to modify and manage calendar events without having access to sensitive data or other admin functions.
- Chrome Device Settings Admin: Managing Chromebooks can be divided into three primary areas: device settings, user settings, and application settings. By creating custom roles for each of these areas, you can distribute Chromebook management tasks without risking cross-interference.
⚠️ Avoiding Common Mistakes: Fine-Tuning Your Delegation
When assigning a custom admin role, always double-check the scope of permissions. Google allows you to define roles based on organizational units, which means you can limit a user’s administrative control. This step is crucial to avoid unintentional actions, like password resets or app approvals, affecting the wrong group of users.
It’s also important to educate those given admin roles about the boundaries of their responsibilities. Providing documentation or training on their specific roles will help them navigate their tasks effectively, reducing the likelihood of errors.
WARNING: Some roles are domain-wide by nature. Like OU Creator or API Manager. So if you assign this type of privilege in the role, you will not be able to restrict the use of this Admin Role to an OU. It will be assigned to the whole domain by default. The button to select will then be greyed out.
🚨 A Word of Caution: Keep Super Admin Access Tight
The Super Admin role is the most powerful in Google Workspace, allowing complete control over all aspects of the system. While it may be tempting to assign this role to multiple users, it’s essential to restrict it to a small group of trusted individuals. Always keep the Rule Of Least Privilege in mind. The Super Admin has access to everything, including the ability to modify billing and subscription details and even delete the Workspace Account!!!. So exercise caution when distributing this level of access.
Custom Google admin roles are a flexible and powerful way to delegate tasks, but it’s important to ensure that the right balance is struck between access and security.
Any questions, comments, or reactions about our article, we’re happy to hear that in the comment section below. We always love diving into healthy discussions. If you also feel that you haven’t been using Google Workspace at its best, reach us at (Cloud Sultans: contact@cloudsultans.com). We offer free consultation or system audit to find you the best possible solution.
