# 6 Super-admin separation & minimal count

> v0.1.2 · role: Prevent · [policy: #4 · #28](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

Unlocks: [№19 Break-glass admin + offline backup codes](breakglass-admin.md) · [№24 Native multi-party approval](multi-party-approval.md) · [№42 Scripted JIT admin elevation](jit-admin-elevation.md)

Superadmin is the highest privilege level in Google Workspace. Superadmins can read any mailbox, reset any password and unwind any setting on this list. Because it is so powerful, superadmin accounts should only be used for administration: users superadmin access should have daily-driver accounts with typical user permissions. This control caps the number of superadmins and moves the role onto dedicated admin-only identities. We also turn off mail flow and  third-party OAuth grants. This protects your most sensitive accounts from phishing exposure. Everyday accounts drop to the narrowest role that does their job.

Documentation: [Security best practices for administrator accounts](https://knowledge.workspace.google.com/admin/users/security-best-practices-for-administrator-accounts)

## Caveats

- Prebuilt delegated roles cannot manage any administrator account — only a super admin can reset an admin's password or assign admin privileges. Custom roles are different: a custom role that can reset another admin's password or assign roles escalates stepwise to super admin, so check the privilege set of every custom role.
- Do not delete the last super admin, and keep the break-glass account (№19) out of this cleanup entirely.

## Setup steps

1. Open the Super Admin role and list its assignees. Count them. — `Account › Admin roles › Super Admin`

   - **Super admins** = 2–4 named humans, no more

   docs: [Assign specific admin roles](https://knowledge.workspace.google.com/admin/users/assign-specific-admin-roles)

2. For each human who needs admin rights, create a dedicated admin identity separate from their mail-reading daily account. — `Directory › Users`

   admin-<name>@<domain>, no mail flow, no third-party OAuth grants
   Note: Google is phasing in mandatory 2SV for admin accounts (currently enforced for Education, Nonprofits, Cloud Identity, Android Enterprise and Enterprise editions using third-party SSO, with more to follow) — enrol the new admin identities in 2SV before assigning the role; once enforcement applies, an unenrolled admin loses mobile access at day 15 and web access at day 30.

   docs: [Make a user an admin](https://knowledge.workspace.google.com/admin/users/make-a-user-an-admin)

3. Downgrade day-to-day accounts to the narrowest prebuilt role that does their job (User Management, Help Desk, Services), and revoke Super Admin from them. — `Account › Admin roles`

   - **Daily accounts** = delegated role only
   - **Super Admin** = admin-* identities

   docs: [Prebuilt administrator roles](https://knowledge.workspace.google.com/admin/users/prebuilt-administrator-roles) · [Remove Google Workspace administrator privileges](https://knowledge.workspace.google.com/admin/users/remove-google-workspace-administrator-privileges)

4. Record the roster in the register ([№5](account-inventory.md)) and set a recertification date ([№43](access-recertification.md)). — `Account › Admin roles › <role> › Admins`

   Roster exported and dated

## Ongoing maintenance

- **[automatable: script]** Quarterly: re-run the super-admin enumeration and re-attest each entry (folds into the [№43](access-recertification.md) recertification cycle).

## How to verify

1. Count the super admins and check they are dedicated admin-only identities (no mail flow, no OAuth grants).

   ```
   gam print users query "isAdmin=true" fields primaryEmail,lastLoginTime
   ```

2. The list should be 2–4 accounts, every one a dedicated admin identity — a daily-driver mailbox in this list is the finding.

## Settings screens

- Account > Admin roles > Super Admin
  - console: https://admin.google.com/ac/roles/65252159033180161/admins
  - screenshot: ../screenshots/admin.google.com/ac/roles/65252159033180161/admins.png
- Account > Admin roles
  - console: https://admin.google.com/ac/list/roles
  - screenshot: ../screenshots/admin.google.com/ac/list/roles.png
- Directory > Users (create the separate admin identity; verify no daily-driver account is an admin)
  - console: https://admin.google.com/ac/users
  - screenshot: ../screenshots/admin.google.com/ac/users.png