How many super admins should a small company have?

At least two, held by two different people. Google's prebuilt roles page requires at least one and recommends at least two so that one admin can reset the other's password, and its security best practices page adds that each super admin should also have a separate everyday account for mail and documents. More than two in a company under 50 people is usually role creep rather than a decision.

Can I limit a Google Workspace admin to one office or department?

Yes for most roles, no for Super Admin, which always applies to the whole organization. Only certain privileges can be scoped to an organizational unit, and adding any other privilege to a custom role removes the option entirely. In the console you can tell because the Edit control next to All organizational units only appears on roles that can be scoped. Enforcing or disabling 2-Step Verification is one security action that cannot be limited to a unit.

Can a help desk admin read other people's email?

Not with the Help Desk Admin role, which resets passwords for non-admin users and views profiles and the organizational structure. Reading message content means Google Vault privileges, where Manage Searches shows the contents of messages and files a search returns. Email Log Search finds messages by sender, date or message ID but Google states it cannot show message contents, and the Gmail Settings privilege changes routing and compliance rules rather than opening mailboxes.

Google Workspace admin roles: who needs super admin

Say a 12-person logistics company. Four people hold Super Admin: the owner, the office manager, the person who set the domain up three years ago and now works two days a week, and a contractor who needed it for one afternoon in 2024. Nobody was careless. Each got the role because the alternative was a half-hour conversation about privileges nobody had time for.

That is the normal shape of a small Google Workspace tenant, and it stays harmless until the day it does not. One phishing message reaches one of those four accounts and the attacker inherits the whole organization. Somebody deletes a user to free a licence and takes their Gmail with it. Admin access is the one part of Workspace where the lazy decision and the correct one look identical from outside, for years. Here is the order we work in.

Two super admins, owned by two people

Google's own guidance, read on 13 October 2026, is specific about this. The prebuilt roles page says an organization needs at least one super administrator and recommends at least two, so that if one of you forgets a password the other can reset it. The security best practices page for administrator accounts goes further: more than one super admin account, each managed by a separate individual rather than shared, and two accounts for every super admin, one for admin work and one for everyday mail and documents.

The reason that last part matters is recovery. Super admin self-recovery is a per-organization setting in the Admin console, and Google documents it as off by default on several editions, among them Business Plus, Education Standard and Education Plus, Enterprise Essentials Plus and Cloud Identity Premium. With self-recovery off and one super admin locked out, the paths left are another super admin or Google support, and the support path means proving you own the domain by publishing a DNS record Google asks for. One super admin account on a plan where self-recovery is off is one lost phone away from a support ticket. Two accounts held by two people make it a five-minute password reset. We covered the lockout mechanics separately.

Two limits are worth knowing before you plan anything clever. Super Admin cannot be narrowed to one department. Every other role can be set to apply to specific organizational units, and that one covers the whole organization by design. And it is the one role you cannot assign to a service account, worth remembering if an integration ever asks for it.

What we check before changing a single assignment

Four reads, in this order, none of which change anything.

Who holds what today. The central page is Menu, then Account, then Admin roles, which lists every role with its assignees. Count the super admins out loud. In most tenants we audit, the number surprises the owner.
Which assignments arrive through a group. Roles go to users, groups and service accounts, and a group assignment follows the group's membership automatically, which is the feature and the trap in one. Adding somebody to a group can make them an administrator with nothing shown next to their name.
Which privileges read people's data, which is not the same question as who is an admin. More on this below.
Whether the admin accounts are protected. Two-Step Verification on every one, security keys where the budget allows, recovery information that points outside the tenant.

Take the role off the shelf before you build one

Most small teams need two or three prebuilt roles and nothing custom. The ones that earn their place under 50 people:

Help Desk Admin. Resets passwords for non-admin users and views user profiles and the organizational structure. This is the role for the person who gets asked to fix sign-ins, and it can be limited to one organizational unit.
User Management Admin. Most actions on non-admin users: create, delete, rename, reset. It deliberately cannot touch administrator accounts, which only a super admin can act on, and that boundary is the reason to use it instead of Super Admin.
Groups Admin. Full control of Groups tasks, with narrower Groups Reader and Groups Editor variants if all you need is visibility. Worth pairing with how you use groups as the access boundary for Drive and Calendar.
Services Admin. Turns services on and off and changes their settings, including Calendar resources, Chrome and devices. Google's role page does not list Gmail among its tasks, so check the privileges in your console before assuming it covers mail.

Custom roles exist for the cases where a job needs privileges from two places at once. The clearest example in Google's documentation: transferring ownership of someone's Drive files needs the Drive and Docs settings privilege, the Data Transfer privilege and the read-only Users privilege together. No prebuilt role bundles those three, so an offboarding helper who should not be able to delete accounts needs a custom role. The cap is 750 custom roles per organization in Google's Directory API guide, so the number is never the constraint. Every custom role is something somebody has to understand in two years.

What we hand to a support person in a small tenant usually looks like this:

Custom role: Support (scoped to /Staff)
  Users        Read
  Users        Reset password
  Users        Force password change
  Organizational Units   Read

Four privileges. It cannot create or delete a user, see billing, change a service setting, or touch anybody outside the Staff unit.

Scope it to the people it is for

Scoping is where plans fall over, so the rule is worth stating plainly: only certain privileges can be limited to an organizational unit, and adding any other privilege to a custom role removes the option entirely. You find out in the console rather than in a warning, because the Edit control next to All organizational units only appears on roles that can be scoped, such as User Management Admin.

Two more facts from the same pages. Enforcing or disabling Two-Step Verification cannot be limited to an organizational unit, so an admin who can do it for one department can do it for everyone. And a group can hold any role except Super Admin and Reseller Admin, which makes a group the right home for the help desk role when the help desk is three people who change.

The privileges that read mail and files

"Admin" and "can read my email" are not the same thing, and the difference lives in three privileges.

The Gmail Settings privilege covers all Gmail settings for the organization. Google's own page on delegating Gmail administration describes what that means in practice: setting up email routing and content compliance rules. Somebody with it cannot read a message, and can quietly redirect every message your domain sends anyway. Email Log Search is a separate privilege that finds messages by sender, date or message ID, and Google states it cannot show message contents. The broad Service Settings privilege selects the Gmail Settings privilege only, not Email Log Search and not admin quarantine access.

Reading content is Google Vault, and Vault privileges are their own set. The Manage Searches privilege lets an admin search organization data and view the contents of the messages and files a search returns. Google says accounts with Vault privileges should be treated as sensitive because they have access to and control over other users' data, that these privileges are not selected automatically with Service Settings, and that Vault keeps its own audit log which cannot be edited. In a 12-person company, nobody needs them as a convenience.

One practical consequence: after any change to who holds Gmail settings, we re-check that the domain still authenticates the way it did last week. A routing or compliance rule added by a well-meaning admin is one of the few ways a healthy sending domain breaks without anybody touching DNS.

Assign it in the order that leaves a trail

The mechanics are short. Open the user's account page, go to Admin roles and privileges, pick the role, and where the role allows it click Edit next to All organizational units, choose the units it covers and save. For several people or a group at once, go to Menu, then Account, then Admin roles, and assign from the role instead of from the person.

Then wait before you test. Google documents that a user typically becomes an admin within a few minutes, but that it can take up to 24 hours. A new admin reporting that they cannot see the console twenty minutes later is usually propagation, not a mistake.

If your edition supports it, multi-party approval fits this work best: a second administrator has to approve changes to sensitive settings, and the role management variant means another super admin approves a role assignment before it applies. It is off by default, needs two or more super admin accounts, is configured in the Security section of the console, and a request expires after three days if nobody acts on it. The honest caveat for a small business: Google lists multi-party approval for Enterprise Standard and Enterprise Plus, Education Standard and Education Plus, and Enterprise Essentials Plus, checked 13 October 2026, so a tenant on a Business plan cannot turn it on and has to rely on the review habit instead.

What we watch afterwards

Admin log events. Role changes land in the Admin audit log, typically within a couple of minutes, and administrators cannot delete log event data or change how long it is kept.
Alerts built on old event names. Google has been renaming a set of Admin log events and states that only the new names and types are available after August 2026, checked 13 October 2026. Any alert wired to an old name is worth re-running once.
Departures. An admin leaving is a different job from a user leaving: it is the offboarding checklist with the role removal first.
The Cloud side, if you have one. Workspace admin roles and Google Cloud IAM are separate systems with the same failure mode. The Cloud half is least privilege for a 10-person company.

How Guanacos Tech helps

We do this as part of Workspace work for small and mid-sized teams across North America and Latin America: count the super admins, move the real jobs onto prebuilt roles, scope what can be scoped, strip the data-access privileges nobody needs, and leave a one-page record of who holds what and why. In a tenant this size it takes an afternoon, and it is the cheapest security work a small company can buy. How we work fits on one page. If you would rather have it done than researched, we are Google Workspace consultants, and half an hour is enough to go through your current role list and say what we would change.

Who needs super admin: handing out Google Workspace admin roles without handing over the company