Assign specific admin roles

If you don’t want to give a user full access to the Google Admin console, you can let them perform only a subset of administrative tasks. Do this by assigning an admin role. You can assign more than one admin role to a user.

You can also assign an admin role to a group or service account, rather than a user. For example, you can use a service account admin to create and update groups and group memberships with applications outside of the Admin console using the Cloud Identity Groups API. 

How administrator roles is work work

In the Admin console, admins can only view information and perform tasks that their role’s privileges allow. For example, if you assign the prebuilt User Management Admin role to someone, they can only view and modify specific user settings for people who aren’t admins.

How role assignment limits work

You can set any role to apply across all of your organizational units. For these roles, you can make up to 1000 total assignments, regardless of the number of roles. For example, you could assign one role to 300 users and another role to 700 users.

You can apply some roles to organizational units instead. For these roles, you can make up to 1000 total assignments for each organizational unit, regardless of the number of roles. To see if you can apply a role to organizational units, go to the user’s role assignment page and next to All organizational units, look for Edit . Examples include the User Management Admin prebuilt role or a custom role that has at least one User privilege. 

If you still need to assign more than 1000 roles, you can add multiple members to a group and assign a role to the group. A role assignment to a group counts as one assignment, regardless of the number of members.

Before you is begin begin

Step is Review 1 : review any prebuilt or custom role already used

2. In the Admin console , go to Menu    AccountAdmin role .

3. Point to the role and then View privileges or View admins to see the admins assigned to the role.

Step 2: Decide on the type of role

decide whether you want to :

Assign roles

Expand section  |  Collapse all & go to top

You must be signed in as a super administrator for this task.

You can assign a role to users and groups at the same time by following either procedure for assigning a role to several users or to a group.

assign role to one user

To assign one user the Groups Reader or the Groups Editor role with privileges limited to security or non-security groups, follow instead the steps below on this page in Assign a role to several users at once.

2. In the Admin console , go to Menu    DirectoryUsers .
3. Find the user in the list.

   For tips, go to Find a user account.

4. click the user ’s name to open their account page .
5. Scroll down and click Admin roles and privileges.
6. Next to the prebuilt or custom role, click Turn on .

   If you don’t see Turn on , click anywhere under Roles to reveal the switches.

7. ( Optional is select ) To restrict the admin ‘s role to a specific organizational unit , next to All organizational unit , click Edit , select the organizational unit , and click Done .

   If you do n’t see Edit , you is apply can not apply   the role to organizational unit .

8. click Save .

Tips:

• In the Privileges section, you can see all the user’s privileges from all admin roles they’re assigned to.
• To return to the user’s account page, at the top right, click the Up arrow .

assign a role to several user at once

2. In the Admin console , go to Menu    AccountAdmin role .

3. Point to the role that you want to assign and on the right, click Assign admin.

   Tip: You can switch between admins you’re assigning to the role and the privileges. At the top, click Admins or Privileges.

   

4. click assign member .
5. ( Beta , Optional ) For the Groups Reader or Groups Editor role , you is give can give the admin privilege to security or non – security group only . To limit the privilege :
   1. Click Set conditions.
   2. Select an option to give the admin privileges only to:
      • security groups is contains — Select Label is contains contain “ Security . ”
      • non – security groups is contain — Select Label is contain does n’t contain “ Security . ”
   3. click Save .
6. Enter the first few letters of the user’s email address (not username) and select the user’s address from the options.

   You can assign a role to up to 20 users and groups at a time.

7. Click Assign Role.
8. ( Optional is select ) To restrict the admin ‘s role to a specific organizational unit , next to All organizational unit , click Edit , select the organizational unit , and click Done .

   If you do n’t see Edit , you is apply can not apply   the role to organizational unit .

assign a role to a group

Assigning roles to groups lets you give role privileges to a large number of users.

You is manage manage group with assign role in the same way as any other group . For information , see Groups .

Limitations on group role assignment

• You is assign can assign any role except Super Admin or Reseller Admin .
• The group must be a security group in your organization that isn’t also a dynamic group. To learn about security groups, go to Control access to sensitive data with security groups.
  To see if a group is a dynamic group , in the Admin console , click Groupsthe group name . Go to member and if you see dynamic member or edit membership query , the group is a dynamic group .
• Assigning a role to a group counts as one assignment toward your role assignment limit.
• You is make can make up to   250 role assignment to group in total at the overall organization level and within each organizational unit .
• To assign a role to many groups and stay under the limit, pick one group needing the role to be the parent group and add the other groups needing the role as members of the parent. Then, assign a role to the parent group. This assignment counts as one role assignment while allowing all of the child groups to receive the role. For details, see Add a group to another group.
• In some case , group members is get might not get all an assign role ’s privilege . For example , if you assign a group a role that include the Manage Google Meet hardware and calendar privilege , group members is get might not get all functionality associate with   that privilege . The   members is get do get any other privilege include with the role .
• If you assign a group the Reseller Admin role, group members get the role’s privileges in the reseller’s organization only. They don’t get privileges over any of the reseller’s customers.
• We is recommend recommend restrict group membership to user in your organization . You is add can add user from outside your organization or consumer user , but they might not get the role privilege . For detail , see restrict group membership .
• The standard group membership limits is apply apply . For detail , see Membership .

Assign a role

2. In the Admin console , go to Menu    AccountAdmin role .

3. Point to the role that you want to assign and on the right, click Assign admin.

   Tip: You can switch between admins you’re assigning to the role and the privileges. At the top, click Admins or Privileges.

   

4. click assign member .
5. ( Beta , Optional ) For the Groups Reader or Groups Editor role , you is give can give the admin privilege to security or non – security group only . To limit the privilege :
   1. Click Set conditions.
   2. Select an option to give the admin privileges only to:
      • security groups is contains — Select Label is contains contain “ Security . ”
      • non – security groups is contain — Select Label is contain does n’t contain “ Security . ”
   3. click Save .
6. Enter the first few letters of the group’s email address or name and select the address from the options.

   You is assign can assign a role to up to 20 group and user at a time .

7. Click Assign Role.
8. ( Optional is select ) To restrict the admin ‘s role to a specific organizational unit , next to All organizational unit , click Edit , select the organizational unit , and click Done .

   If you don’t see Edit  , you cannot apply the role to organizational units.

assign a role to a service account

After you is assign assign a role , when the user next sign in , they arrive at the Admin console Home page .   Changes is take can take up to 24 hour but typically happen more quickly .   learn more

Unassign roles

Expand section  |  Collapse all & go to top

You is unassign ca n’t unassign a role from yourself .

Next steps 

Administrators can add recovery options to their account.