6 Super-admin separation & minimal count

Superadmin is the highest privilege level in Google Workspace. Superadmins can read any mailbox, reset any password and unwind any setting on this list. Because it is so powerful, superadmin accounts should only be used for administration: users superadmin access should have daily-driver accounts with typical user permissions. This control caps the number of superadmins and moves the role onto dedicated admin-only identities. We also turn off mail flow and third-party OAuth grants. This protects your most sensitive accounts from phishing exposure. Everyday accounts drop to the narrowest role that does their job.

Documentation: Security best practices for administrator accounts

Caveats

Prebuilt delegated roles cannot manage any administrator account — only a super admin can reset an admin’s password or assign admin privileges. Custom roles are different: a custom role that can reset another admin’s password or assign roles escalates stepwise to super admin, so check the privilege set of every custom role.
Do not delete the last super admin, and keep the break-glass account (№19) out of this cleanup entirely.

Setup steps

Open the Super Admin role and list its assignees. Count them.

open ↗

https://admin.google.com/ac/roles/65252159033180161/admins · captured 2026-07-15

Account › Admin roles › Super Admin

Super admins

2–4 named humans, no more

Assign specific admin roles
For each human who needs admin rights, create a dedicated admin identity separate from their mail-reading daily account.

open ↗

https://admin.google.com/ac/users · captured 2026-07-15

Directory › Users

admin-<name>@<domain>, no mail flow, no third-party OAuth grants

Google is phasing in mandatory 2SV for admin accounts (currently enforced for Education, Nonprofits, Cloud Identity, Android Enterprise and Enterprise editions using third-party SSO, with more to follow) — enrol the new admin identities in 2SV before assigning the role; once enforcement applies, an unenrolled admin loses mobile access at day 15 and web access at day 30.

Make a user an admin
Downgrade day-to-day accounts to the narrowest prebuilt role that does their job (User Management, Help Desk, Services), and revoke Super Admin from them.

open ↗

https://admin.google.com/ac/list/roles · captured 2026-07-15

Account › Admin roles

Daily accounts

delegated role only

Super Admin

admin-* identities

Prebuilt administrator roles Remove Google Workspace administrator privileges
Record the roster in the register (№5) and set a recertification date (№43).

Account › Admin roles › <role> › Admins

Roster exported and dated

Ongoing maintenance

automatable: script Quarterly: re-run the super-admin enumeration and re-attest each entry (folds into the №43 recertification cycle).

How to verify

Count the super admins and check they are dedicated admin-only identities (no mail flow, no OAuth grants).
```
gam print users query "isAdmin=true" fields primaryEmail,lastLoginTime
```
The list should be 2–4 accounts, every one a dedicated admin identity — a daily-driver mailbox in this list is the finding.

v0.1.2 Prevent policy #4 · #28 ↗