Set admin privileges to protect user privacy

By default, administrator accounts in your organization have access to user content and activity records for Google Workspace services—for example, Gmail and Chat activity records in audit logs. As a super admin, you can help protect your users’ security and privacy by limiting admins only to those privileges that are required for regular use.

For example, you might want to limit the number of admins in your organization who have access to reports and audit logs, the investigation tool, the security dashboard, and the Meet quality tool. For instructions on turning privileges on or off for these services, see the sections below.

Security best practices for admin accounts

Super admins should use a separate user account for day-to-day activities. They should only sign in to their super admin account when they need to perform specific super admin duties. It’s also important for super admins to use 2-Step Verification (2SV)—preferably using security keys—because their accounts control access to all business and employee data in the organization.

For more details, see Security best practices for administrator accounts.

About admin roles and privileges

In the Google admin console, you can turn on admin privileges for specific users by assigning admin roles to those users. You can assign pre-built admin roles or custom admin roles. Similarly, you can turn off admin privileges by unassigning users to admin roles.

To help protect the security and privacy of your users, review the admin privileges in your organization for Reports, the Security dashboard, the Security investigation tool, and the Meet quality tool. See the sections below for more details.

Reports privilege Security dashboard privilege Security investigation tool privileges Meet quality tool privilege

Turn on privileges by assigning an admin role

Assign an admin role:

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountAdmin roles.
3. On the left, click the role that you want to assign.
4. Click Admins.
5. Click Assign users.
6. Find and select up to 20 users.
7. Click Assign role.

Turn off privileges by unassigning an admin role

Unassign an admin role:

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountAdmin roles.
3. On the left, click one of the custom roles in the list.
4. Click Admins.
5. Check the boxes for the admins for which you want to unassign the role.
6. Click Unassign role.
7. To confirm, click Unassign role again.

Add or remove privileges by updating a custom admin role

You can add or remove specific admin privileges for multiple users by updating a custom admin role. For example, if you don’t want a group of users to have the Reports privilege, you can remove that privilege from a custom role that you’ve assigned to those users.

Add or remove admin privileges in a custom admin role:

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountAdmin roles.
3. On the left, click one of the custom roles in the list.
4. Click Privileges.
5. Check or uncheck the boxes for the privileges that you want to add or remove in the admin role.
6. Click Save.

For example, to turn off the Reports privilege, uncheck the Reports check box. To turn off privileges for the security dashboard, go to the Security Center section and uncheck the Dashboards box.

Turn off privileges by deleting a custom admin role

To delete a custom admin role, you can't be assigned to the role or remove yourself. Contact another super admin to have them remove you from the role. 

Turn off privileges for delegated admins by deleting a custom admin role:

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountAdmin roles.
3. Click the custom role that you want to delete.
4. Click Delete role.
5. To confirm, click Delete role again.

For more details and instructions, see Create, edit, and delete custom administrator roles.

Related topics

For general information and instructions about admin roles and privileges, see the following help articles:

• View a user’s roles and privileges
• Make a user an admin
• Create, edit, and delete custom administrator roles
• Pre-built administrator roles
• Assign specific admin roles
• Administrator privilege definitions