Hello Reader,

Whenever I perform a Google Workspace domain audit for a school district, reviewing admin roles is a standard part of my review process.

Here are three common mistakes that I uncover:

1. 🥳 Super admin party: Anywhere from 5 to 10 people have full Super Admin privileges, including department heads, high school principals, and an outside contractor who configured wireless access points back in 2021.
2. 👻 Ghost accounts: vendors, suspended users, and individuals who have changed roles, still have active admin rights
3. 🚨 No backup plan: small districts with only one IT admin fail to configure an emergency backup account. What happens if the primary admin gets locked out?

🆕 Last week Google just rolled out a long-overdue security feature: Expiring Administrator Roles. This new feature is a perfect opportunity to review your current admin assignments and lock down access across your district.

🍁 First session starts October 6!

The Google Admin Bootcamp is a comprehensive overview of the Google Admin console for new and experienced IT admins. Here are a few of the key topics we will explore:

• Organizational unit recommendations
• Managing policies with security groups
• Managing AI agents
• Auditing your workspace configuration

The fall cohort is limited to 30 participants.

• Dates: October 6, 8, 13, 15, and 20
• Location: LIVE via Google Meet (sessions are recorded)
• Time: 1-2:30 pm EST
• Cost: $299/person

⏳ New Feature: expiring admin access

Google just introduced the ability to assign temporary, time-bound administrator roles directly within the Admin Console: Account > Admin Roles

Instead of granting permanent privileges, you can now specify an exact expiration date and time when assigning a system or custom role. Once the deadline passes, Google automatically revokes the role.

How to use this new feature:

• Vendor support: When an outside hardware vendor or partner is assisting with your fall Chromebook deployment or student SIS sync, you no longer have to leave their access open indefinitely.
• Temporary coverage: If you are out on leave or attending a conference, you can grant temporary elevated access to a colleague that automatically shuts off when you return.
• Student tech interns: Assign building-level device privileges to student help desk workers that cleanly expire on the final day of the semester.

🔑 Four Standard Admin Roles:

Here is a quick refresher on Google’s default system roles and what they actually allow:

• Super Admin: The ultimate "god power." Super Admins have unrestricted access to every single feature, service, data log, and user account across your entire domain. They can delete the domain, wipe out accounts, and change SSO configurations. Only 2–3 individuals should ever hold this role.
• Services Admin: Services Admins can configure policies and settings across all Google Workspace services (Gmail, Drive, Classroom, etc), but they cannot manage users.
• User Management Admin: This role can create, edit, suspend, and delete user accounts, but cannot change any domain policies.
• Help Desk Admin: This role is restricted to password resets only and cannot delete or move user accounts.

Upcoming Events for Google Admins

Want to host a Google Admin workshop in your area? Get in touch!

• ​Google Admin Bootcamp (Online) - October 6-20, 2026
• ​MassCUE Conference (Foxborough, MA) - Oct. 14, 2026
• ​Google Admin Bootcamp (Atlanta, GA) - Oct. 27, 2026
• ​Chromebook Academy (Online) - Nov. 5 - 19, 2026 (join wait list)
• ​HECC Conference (Indianapolis, IN) - Nov. 11-13, 2026
• ​Brainstorm Poconos (Pocono Manor, PA) - Nov. 15-17, 2026

🛡️ 5 Best Practices for Managing Admin Roles

While expiring roles solve the vendor problem moving forward, you still need to review your current permissions. Here are the core rules I recommend for keeping your domain secure:

1. Keep Super Admin Access to 2–3 Accounts Maximum

Keep your everyday Super Admins down to a primary admin, a qualified backup, and an emergency account. If someone only needs to manage software or users, use a delegated role instead.

2. Lock Roles to Specific Organizational Units (OUs)

Whenever possible, scope delegated roles to an OU rather than domain-wide:

• Have a high school media specialist who helps reset student passwords? Give them the Help Desk Admin role scoped strictly to the /Students/High School OU.
• Need an office secretary to manage building enrollment? Assign User Management Admin scoped only to their school's student OU. They won't be able to touch staff accounts or see students from other buildings.

3. Build Custom Roles:

Google's pre-built roles are often too broad. Depending on your needs, you may need to create a custom admin role. Here are three common roles that I recommend:

• Senior IT Lead: Rather than giving super admin access to everyone in the tech department, you may need to create a custom role that provides 90% of the capabilities of a super admin, without a few key sensitive actions.
• Chromebook Technician: Delegate hardware management (reboot, disable, powerwash, OU moves) to building techs without giving them access to user mailboxes or security logs.
• Google Vault Auditor: If legal counsel or a compliance officer needs to review FOIA matters, create a custom Vault role that limits them strictly to viewing holds or specific investigations.

👉 Click here for detailed instructions on how to configure these custom roles.

4. Keep school admins out of the console

Administrators often ask for Admin Console access. In practice, building principals and superintendents almost never need direct access to the console. Handing them an admin login introduces a severe phishing target and creates a risk of accidental policy changes from untrained users.

5. Create a "break-glass" emergency admin account

What happens if your primary identity provider (like ClassLink or Clever) goes down, SSO fails, or your standard Super Admin account is compromised?

• Maintain one "secret," unadvertised Super Admin account configured directly in Google (not synced from Active Directory or your SIS).
• Protect it with a strong password, require hardware security keys (FIDO2/YubiKey) or strict 2FA, store the emergency recovery codes in a physical safe, and configure an Alert Center rule to notify you whenever that account logs in.

Taking a few minutes to clean up your admin roles will dramatically reduce your risk exposure and give you peace of mind that nobody is holding the keys who shouldn't be.

During my fall Admin Bootcamp (starts Oct. 6) we will talk more about expiring admin roles. Registration is open...I hope you will join me!