Assign Google Cloud reseller roles & permissions

Users with the Google Cloud Reseller Administrator role can manage all Google Cloud resale tasks in the Partner Sales Console.

What this administrator can do in the Partner Sales Console

The Google Cloud Reseller Administrator has the following permissions in the Partner Sales Console. The permissions apply only to the reseller billing accounts where the user has the Billing Account Administrator role.

• View a customer's Google Cloud subscriptions (billing subaccounts)
• View all Google Cloud customer accounts and edit account information
• Place a Google Cloud order (create a billing subaccount)
• Manage permissions to a subscription (billing subaccount)
• Look up a customer's order details. For details, go to View a customer's order history.
• Assign roles to users and groups in the Partner Sales Console.
• Connect unassigned billing subaccounts to customers and close subscriptions. For details, go to Assign Google Cloud customers to their billing subaccounts.
• View the dashboard. For details, go to Dashboard for Google Cloud.
• View and edit customer accounts that have both Google Cloud and Google Workspace subscriptions, and customer accounts with no subscriptions.

Automatic role assignment

The Google Cloud Reseller Administrator role and Billing Account Administrator roles are linked. Users and groups are automatically granted the Google Cloud Reseller Administrator role if they meet the following requirements:

1. They have an account on your reseller domain, for example, [email protected]. Groups can contain external users, but those users aren't granted the Google Cloud Reseller Administrator role.

2. They have the Billing Account Administrator role on one or more of your reseller billing accounts.

Tip: Billing Account Administrators can assign the Billing Account Administrator role to users and give them access to the Partner Sales Console. For details, go to Manage access to Cloud Billing accounts. 

Role assignments are synced one-way from Google Cloud to the Partner Sales Console. Removing permissions in Google Cloud also removes the user's role in the Partner Sales Console for the billing account.

Assign the role in the console

You can assign the Google Cloud Reseller Administrator role to a user or group in the Partner Sales Console. For details, go to Assign a role to a user (later on this page).

Users with Google Cloud Reseller Viewer role can view customers, their subscriptions, private offer plans, and private offers.

What the Viewer can do in the Partner Sales Console

The Google Cloud Reseller Viewer has the following permissions in the Partner Sales Console. The permissions apply only to the reseller billing accounts where the user has the Billing Account Viewer or Billing Account Costs Manager role.

• View a customer's Google Cloud subscriptions (billing subaccounts).
• View customer accounts that have both Google Cloud and Google Workspace subscriptions.
• View customer accounts with no subscriptions.
• View customer metrics and trends in the dashboard. For details, go to Dashboard for Google Cloud.
• View the order history for a customer.
• View private offer plans and private offers.

Automatic role assignment

Users and groups are automatically granted the Google Cloud Reseller Viewer role if they meet the following requirements:

Role assignments are synced one-way from Google Cloud to the Partner Sales Console. Removing permissions in Google Cloud can also remove the user's role in the Partner Sales Console for the billing subaccount.

Assign the role in the console

You can assign the Google Cloud Reseller Viewer role to a user or group in the Partner Sales Console. For details, go to Assign a role to a user (later on this page).

Users with the Marketplace Order Specialist role can manage private offer plans from build partners and create private offers based on the plans. The role is not limited to specific reseller billing accounts.

What the Specialist can do in the Partner Sales Console

The Marketplace Order Specialist has the following permissions in the Partner Sales Console:

• Review private offers from build partners
• Accept or reject private offer plans
• Create private offers for customers

Tip: Consider pairing this role with the Google Cloud Reseller Viewer role. Doing so allows the Marketplace Order Specialist to also have access to detailed account information.

Assign the role in the console

You can assign the Marketplace Order Specialist role to a user or group in the Partner Sales Console. For details, go to Assign a role to a user (later on this page).

Entitlement Managers can view customers, set permissions to a billing subaccount, and view some information in the dashboard.

What the Manager can do in the Partner Sales Console

The Entitlement Manager has the following permissions in the Partner Sales Console. The permissions apply only to the billing subaccounts where the user has the Billing Account Manager role.

• Manage permissions to a subscription (billing subaccount).
• View a customer's Google Cloud subscriptions (billing subaccounts).
• View customer accounts that have both Google Cloud and Google Workspace subscriptions.
• View customer accounts with no subscriptions.
• View some customer metrics and trends in the dashboard. For details, go to Dashboard for Google Cloud.
• View the order history for a customer.

Automatic role assignment

Users and groups are automatically granted the Entitlement Manager role if they meet the following requirements:

Entitlement Viewers can view customers and their subscriptions, and some information in the dashboard.

What the Viewer can do in the Partner Sales Console

The Entitlement Viewer has the following permissions in the Partner Sales Console. The permissions apply only to the billing subaccounts where the user has the Billing Account Viewer role.

• View a customer's Google Cloud subscriptions (billing subaccounts).
• View customer accounts that have both Google Cloud and Google Workspace subscriptions.
• View customer accounts with no subscriptions.
• View some customer metrics and trends in the dashboard. For details, go to Dashboard for Google Cloud.
• View the order history for a customer.

Automatic role assignment

Users and groups are automatically granted the Entitlement Viewer role if they meet the following requirements:

Role assignments are synced one-way from Google Cloud to the Partner Sales Console. Removing permissions in Google Cloud can also remove the user's role in the Partner Sales Console for the billing subaccount.

1. Sign in to the Partner Sales Console.
2. At the top, click Menu  Settings .
3. Click Reseller roles.
4. To view administrators and their permissions on reseller billing accounts, next to the role, click Down.

You must be a Cloud Identity or Google Workspace super administrator or have the Google Cloud Reseller Administrator role for this task.

Before you begin: Make sure the user or group has an account on your reseller domain, for example, [email protected].

1. Sign in to the Partner Sales Console.
2. At the top, click Menu  Settings .
3. Click Reseller roles.
4. Click Add member and enter a user or group address.
5. Select the role or roles you want to give the user. If you select only the Marketplace Order Specialist role, skip to step 7.
6. For Google Cloud Reseller Administrator and Google Cloud Reseller Viewer, click Google Cloud billing accounts and select the accounts you want to add to the role.

   Accounts aren't selected by default, regardless of the user or group's permissions set in Google Cloud.

7. Click Save.

   The changes might take a few minutes to appear in Google Cloud.

You must be a Cloud Identity or Google Workspace super administrator or have the Google Cloud Reseller Administrator role for this task.

Changing a user's Partner Sales Console roles and permissions also changes their Google Cloud Billing roles and permissions.

Tip: You can turn off a user's access to the Partner Sales Console without changing their access to the reseller billing accounts. To do so, remove the Google Cloud Reseller Administrator role from the user and leave access to the billing accounts unchanged.

1. Sign in to the Partner Sales Console.
2. At the top, click Menu  Settings .
3. Click Reseller roles.
4. Next to the user or group, click Edit .
5. Check the boxes next to the roles that you want to add and uncheck the roles you want to remove.
6. If you're adding the Google Cloud Reseller Administrator or Google Cloud Reseller Viewer role, click Google Cloud billing accounts and select the accounts you want to add to the role. Uncheck the accounts you want to remove.

   Accounts aren't selected by default, regardless of the user or group's permissions set in Google Cloud.

7. Click Save.

   The changes might take a few minutes to appear in Google Cloud.

The user isn't automatically assigned a Google Cloud reseller role or the Partner Sales Console doesn't show any information

The user might have their Google Cloud Billing role assigned at the organization level. Assign the Google Cloud Reseller Administrator role with permissions on one or more of your reseller billing accounts.

Error message "Logged in user is not authorized..."

The user can sign in to the Partner Sales Console but can't access any features. Check that the user has a Partner Sales Console role and permissions on one or more of your reseller billing accounts or billing subaccounts.

Error message "Can't find email address in your Cloud Identity or Google Workspace account"

The user doesn't have an account in your reseller domain. Users outside of your domain can't be assigned the Partner Sales Console role.

The console doesn't show all of my reseller billing accounts

You might be missing the Billing Account Administrator role on one of your reseller billing accounts. Check with another super administrator in your organization.