View role assignments & privileges

As an administrator for your organization’s Google Workspace or Cloud Identity account, you can see a list of all the admin roles and privileges assigned to a user or group. You can also see a list of all the direct assignments for a given role. This information can help you to quickly determine a user’s or group’s level of administrative access to your organization’s Google Workspace account and services.

You must be signed in as a super administrator for this task.

View a user’s roles & privileges

On a user’s page, you can see roles directly assigned to a user and roles a user indirectly receives as a member of a group that was assigned the role.

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  DirectoryUsers.
3. Find the user in the list. If you need help, see Find a user account.
4. Click the user’s name to open their account page.
5. Click Admin roles and privileges. 
    

   
    

6. In the Roles list, in the Assigned status column, review the roles assigned to the user.
7. Scroll to Privileges to review all the user’s privileges. For each privilege, you can see the role it was inherited from and which organizational units it applies to.
8. (Optional) To return to the user’s account page, for Admin roles and privileges, click the Up arrow  .

View a group’s roles & privileges

On a group’s page, you can see roles directly assigned to a group and roles a group indirectly receives as a member of another group that was assigned the role.

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  DirectoryGroups.
3. Find the group in the list.
4. Click the group’s name to open its account page.
5. Click Admin roles and privileges. 
6. In the Roles list, in the Assigned status column, review the roles assigned to the group.
7. Scroll to Privileges to review all the group’s privileges. For each privilege, you can see the role it was inherited from and which organizational units it applies to.
8. (Optional) To return to the group’s account page, for Admin roles and privileges, click the Up arrow  .

View direct assignments for a role

On the Roles page, you can see all users and groups that have a role directly assigned to them. You can’t see the roles that are indirectly assigned to users or groups that are members of a group receiving the role.

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountAdmin roles.
3. Click the role that you want to reviewAdmins.

Change a role assignment

For information about changing a user’s or group’s role assignment, go to Assign specific admin roles.