Reference
The super admin role in Google Workspace
A Google Workspace super admin holds every administrative privilege in the tenant, including billing, user deletion and the ability to grant themselves access to any account. Google recommends holding at least 2 super admin accounts so recovery is possible if one is lost.
| Scope | Every service, every user, every setting in the tenant |
|---|---|
| Recommended count | At least 2, rarely more than 4 |
| Recovery | A super admin is required to recover a lost primary admin account |
| Delegated roles | Scoped privileges such as user management or help desk only |
| Audit trail | Super admin actions are recorded in the admin audit log |
Why the count matters more than the person
A single super admin is a recovery failure waiting to happen: if that account is lost, locked or leaves badly, no one inside the organisation can restore access without a lengthy verification process with Google.
A long list of super admins is the opposite failure. Each one can read any mailbox, remove any user and change billing, and the audit log tells you afterwards rather than preventing it.
What to use instead for day-to-day work
Delegated admin roles cover almost all routine work: creating users, resetting passwords, managing groups and running reports. Help desk staff should never hold super admin to do password resets.
The practical arrangement is two or three named super admin accounts used deliberately and rarely, with everyone else holding the narrowest delegated role that covers their job.
What we see that others don't say
An excessive super admin count is the single most common finding in the Workspace security audits we run, ahead of missing two step verification enforcement and stale third-party app grants.
What this doesn't cover
- Role design controls Workspace administration only; Google Cloud projects use a separate IAM model.
- An audit log records super admin actions but does not prevent them, so the count is the control.
Questions we get asked
- Can a Google Workspace super admin read user email?
- A super admin can grant themselves the access needed to read any mailbox, including through Vault search where licensed. The action is recorded in the audit log, but nothing in the platform blocks it.
- How many super admins should a small business have?
- Two or three. Two is the minimum for safe recovery if one account is lost, and beyond three or four the risk of an unnoticed privileged change outweighs the convenience.
How this page is verified
Reviewed by Pearl Lemon Cloud security desk, Workspace security and compliance reviewers. Last checked .
- Role capabilities verified against Google's administrator privilege documentation at the review date.
- Frequency claim drawn from the findings register of security audits we have delivered.
Sources you can check
Related pages
Not sure who holds admin rights in your tenant?
A security audit lists every privileged account and delegated role, flags the ones nobody can account for, and returns a role design your help desk can still work inside.