Assign specific admin roles

To assign one user the Groups Reader or Groups Editor role with privileges limited to security or non-security groups, or to locked or unlocked groups, go to Assign a role to several users at once.

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  DirectoryUsers.
3. Find the user in the list.

   For tips, go to Find a user account.

4. Click the user’s name to open their account page.
5. Scroll down and click Admin roles and privileges.
6. Next to the prebuilt or custom role, click Turn on .

   If you don’t see Turn on , click anywhere under Roles to reveal the switches.

7. (Optional) To restrict the admin's role to a specific organizational unit, next to All organizational units, click Edit , select the organizational units, and click Done.

   If you don’t see Edit , you cannot apply the role to organizational units.

8. Click Save.

Tips:

• In the Privileges section, you can see all the user's privileges from all admin roles they’re assigned to.
• To return to the user’s account page, at the top right, click the Up arrow .

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountAdmin roles.
3. Point to the role that you want to assign and on the right, click Assign admin.

   Tip: You can switch between admins you’re assigning to the role and the privileges. At the top, click Admins or Privileges.

   

4. Click Assign members.
5. (Optional) For the Groups Reader or Groups Editor role, you can give the admin privileges only to security or non-security groups, or only to locked or unlocked groups. To limit the privileges:
   1. Click Set conditions.
   2. Select an option to give the admin privileges only to:
      • Security groups—Select Label contains “Security.”
      • Non-security groups—Select Label doesn’t contain “Security.”
      • (Beta) Locked groups—Select Label contains “Locked.”
      • (Beta) Unlocked groups—Select Label doesn’t contain “Locked.”
   3. Click Save.
6. Enter the first few letters of the user's email address (not username) and select the user’s address from the options.

   You can assign a role to up to 20 users and groups at a time.

7. Click Assign Role.
8. (Optional) To restrict the admin's role to a specific organizational unit, next to All organizational units, click Edit , select the organizational units, and click Done.

   If you don’t see Edit , you cannot apply the role to organizational units.

Assigning roles to groups lets you give role privileges to a large number of users.

You manage groups with assigned roles in the same way as any other groups. For information, see Groups.

Limitations on group role assignment

• You can assign any role except Super Admin or Reseller Admin.
• The group must be a security group in your organization that isn’t also a dynamic group. To learn about security groups, go to Control access to sensitive data with security groups.
  To see if a group is a dynamic group, in the Admin console, click Groupsthe group name. Go to Members and if you see Dynamic members or Edit membership query, the group is a dynamic group.
• Assigning a role to a group counts as one assignment toward your role assignment limit.
• You can make up to 250 role assignments to groups in total at the overall organization level and within each organizational unit.
• To assign a role to many groups and stay under the limit, pick one group needing the role to be the parent group and add the other groups needing the role as members of the parent. Then, assign a role to the parent group. This assignment counts as one role assignment while allowing all of the child groups to receive the role. For details, see Add a group to another group.
• In some cases, group members might not get all an assigned role’s privileges. For example, if you assign a group a role that includes the Manage Google Meet hardware and calendars privilege, group members might not get all functionality associated with that privilege. The members do get any other privileges included with the role.
• If you assign a group the Reseller Admin role, group members get the role’s privileges in the reseller’s organization only. They don’t get privileges over any of the reseller’s customers.
• We recommend restricting group membership to users in your organization. You can add users from outside your organization or consumer users, but they might not get the role privileges. For details, see Restrict group membership.
• The standard group membership limits apply. For details, see Membership.

Assign a role

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountAdmin roles.
3. Point to the role that you want to assign and on the right, click Assign admin.

   Tip: You can switch between admins you’re assigning to the role and the privileges. At the top, click Admins or Privileges.

   

4. Click Assign members.
5. (Optional) For the Groups Reader or Groups Editor role, you can give the admin privileges only to security or non-security groups, or only to locked or unlocked groups. To limit the privileges:
   1. Click Set conditions.
   2. Select an option to give the admin privileges only to:
      • Security groups—Select Label contains “Security.”
      • Non-security groups—Select Label doesn’t contain “Security.”
      • (Beta) Locked groups —Select Label contains “Locked.”
      • (Beta) Unlocked groups—Select Label doesn’t contain “Locked.”
   3. Click Save.et
6. Enter the first few letters of the group’s email address or name and select the address from the options.

   You can assign a role to up to 20 groups and users at a time.

7. Click Assign Role.
8. (Optional) To restrict the admin's role to a specific organizational unit, next to All organizational units, click Edit , select the organizational units, and click Done.

   If you don’t see Edit  , you cannot apply the role to organizational units.

You can assign any prebuilt or custom role except Super Admin to a service account. Assigning a role to a service account counts toward your role assignment limit.

Before you begin: Set up a service account in Google Cloud. Go to Creating and managing service accounts.

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountAdmin roles.
3. Point to the role that you want to assignclick Assign admin.
4. Click Assign service accounts.
5. (Optional) For the Groups Reader or Groups Editor role, you can give the admin privileges only to security or non-security groups, or only to locked or unlocked groups. To limit the privileges:
   1. Click Set conditions.
   2. Select an option to give the admin privileges only to:
      • Security groups—Select Label contains “Security.”
      • Non-security groups—Select Label doesn’t contain “Security.”
      • (Beta) Locked groups—Select Label contains “Locked.”
      • (Beta) Unlocked groups—Select Label doesn’t contain “Locked.”
   3. Click Save.
6. Enter the email address of the service account.

   To find the email address, open the Google Cloud console and click Menu IAM & AdminService Accounts.

7. Click AddAssign role. 

What happens next? 

In the Admin audit log, you can see when an admin role was applied to a service account and a record of actions performed by service account admins. For details, go to Admin log events. 

If you applied the Groups Admin prebuilt role to a service account, you can also see actions in the Enterprise groups audit log. The service account admin might be listed under Event Description or User. For details, go to Group Enterprise log events.

Related topic

• Authenticating as a service account without domain-wide delegation