Assign admin roles to a service partner

After your organization purchases products or services from Google or a reseller, you can appoint a service partner to manage the one-time setup or day-to-day administration of your Google subscriptions.

A service partner provides post-sales services and support but does not resell Google products to you.

Before you begin: Understand your responsibilities

When you appoint a service partner, you are responsible for:

• Determining and managing the correct level of access for your service partner
• Managing the terms of your relationship with your service partner

Step 1: Request access to the pilot program

We’re currently offering this feature as a pilot program to a restricted set of customers. To join the pilot:

1. Fill out this form.
2. Wait for a confirmation email from Google that you’re part of the pilot program. If you don’t receive an email within a week, you haven’t been added to the pilot.

Step 2: Review role & privilege options

To give your service partner preset privileges to perform common business functions, you can assign your service partner a prebuilt administrator role.

Note: Service partners can’t be assigned Super Admin privileges.

However, if you want to have more control over the privileges that you give your service partner, you can create a custom role.

Learn more about Administrator privileges.

Step 3: Appoint a service partner & assign a role

You must be signed in as a super administrator for this task.

Before you begin: Ask your service partner to create a security group with the email addresses of their employees who will manage your Google Admin console. For details, go to Control access to sensitive data with security groups.

Then, wait to receive the pilot confirmation email from Google.

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountAdmin roles.
3. Point to the role that you want to assignclick Assign admin.
4. Click Assign users.
5. Enter your service partner’s security group address.
6. Click AddAssign Role.
7. In the address bar, copy the Admin console web address and share it with your service partner.

   This web address is unique to your account and allows your service partner to easily access your Admin console.

8. Click Assign.

If you have any issues setting up a service partner, go to Troubleshooting later on this page.

Edit service partner privileges

If you assigned a prebuilt administrator role to your service partner's security group, you can change the partner’s privileges by creating a custom role and assigning the group to the role.

If you already assigned a custom role to your service partner, you can manage their privileges by editing the role.

For details, go to Create, edit, and delete custom admin roles.

Remove a service partner

You can revoke your service partner’s privileges by unassigning the role assigned to their security group.

You must be signed in as a super administrator for this task.

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountAdmin roles.
3. Point to the role that you want to unassignclick Assign admin.
4. Check the box next to your service partner’s security group.
5. Click Unassign roleUnassign Role to confirm.

Commercial terms for the engagement between you and your service partner are separate from administrator permissions, and you must work directly with your service partner to discuss changes to these terms.

Troubleshooting

Review the following error messages to get help with common issues.

You are not authorized to access this service. Please request access.

You haven’t been granted access to the service partner pilot. To request access, fill out this form.

Wait for Google’s confirmation that you’re part of the pilot program before you follow the previous steps on this page to appoint a service partner.

The user group being added is not a security group.

Ask your service partner to create a security group with the email addresses of their employees who will manage your Admin console. For details, go to Control access to sensitive data with security groups.

The user group being added is not authorized to access this service.

Make sure that you entered the address of the group that you want to authorize as a service partner correctly, without any typos.

If the error persists, ask your service partner to become part of the pilot by filling out this form.

Then, wait for Google’s confirmation that the partner has been added to the pilot program. Currently, we are only admitting authorized Google Workspace resellers into the pilot program.

Dynamic user groups are not authorized to access this service.

The user group that your service partner provided is a dynamic security group. Ask your service partner to instead create a security group that isn’t a dynamic group with the email addresses of their employees who will manage your Admin console. For details, go to Control access to sensitive data with security groups.