Why the smallest role matters
In Level 1 you saw the service on one page. Now we decide which keys the desk holds. Think of admin roles as a building's key cabinet. The cleaner needs a key to the corridors, not the master key to the server room. If someone steals the cleaner's key, little goes wrong. The same is true of a help desk account that has been phished.
During a move from Microsoft 365 to Google Workspace, the pressure to grant Super Admin "just for cutover week" is real. Push back on it. A Super Admin account that gets phished can delete users, read settings across the whole tenant and turn off security controls. A Help Desk Admin account that gets phished can reset passwords for ordinary users in one organisational unit (OU). Both accounts fix the same password ticket, but the damage if they are stolen is very different.
The rule this course uses: choose the prebuilt role with the fewest privileges that closes the ticket, limited to the OUs the desk supports. If no small role covers the ticket, pass it on. Don't ask for more access.
The Google prebuilt roles a desk meets
The table below follows Google's "Prebuilt administrator roles" page, last updated 26 October 2026. Roles change, so check this against the console (see the walkthrough below).
Role OU-limited? What it's for (summary)
---------------------- ----------- ----------------------------------------------
Help Desk Admin Yes First-line tasks: password resets for non-admin users
User Management Admin Yes Create, delete, rename users, reset passwords,
per-user security settings (non-admins only)
Groups Reader No Read-only view of groups
Groups Editor No Groups Admin minus security-label management
Groups Admin No Create, delete, manage groups and members
Super Admin No Everything, including other admins
Two details matter:
- Only Help Desk Admin and User Management Admin can be limited to an OU. The group roles always cover the whole tenant. Granting Groups Editor to five desk staff gives all five access to every group in the organisation.
- No delegated role can reset an administrator's password. Only a Super Admin can. When a fellow admin is locked out, the ticket always goes to the Super Admin holders.
Matching jobs to roles
Ticket Smallest fit Notes
-------------------------------------------- --------------------------- -----------------------------
"I forgot my password" (normal user) Help Desk Admin, OU-limited Most common week-one ticket
"Change my surname / job title" User Management Admin, OU Help Desk Admin is not enough
"Add me to the finance-team group" Groups Editor Tenant-wide, so grant to few people
"Let my PA read my mail" (delegation) None; the user does it Owner adds delegate in Gmail settings
"Leaver's Drive files -> their manager" Pass it on (see below) Needs Drive & Docs + Data Transfer
"Reset the IT manager's password" Super Admin only Pass it on, always
Mailbox delegation. Microsoft habit: an Exchange admin grants Full Access to a mailbox. Google fix: once delegation is allowed tenant-wide (Apps > Google Workspace > Gmail > User settings > Mail delegation), the mailbox owner adds the delegate in their own Gmail settings. The desk's job is to walk the user through it, not to hold a mail-admin privilege. If delegation is switched off for the user's OU, that is a tenant-wide policy matter. Escalate it.
File ownership transfer. The admin route is Apps > Google Workspace > Drive and Docs > Transfer ownership. Google's documentation says it needs the Drive and Docs settings privilege, and for the Drive section's data-transfer tool, the Data Transfer privilege as well. No small prebuilt desk role includes these. Most desks escalate with the leaver's address, the recipient's address and the manager's approval attached.
Walkthrough: read a role's privileges, then date it
This is a read-only check. You change nothing.
1. Sign in to admin.google.com with your desk admin account.
2. Menu > Account > Admin roles
3. Point at "Help Desk Admin" > View privileges
# Admin console privileges are listed by area, e.g. Users, Organizational Units
4. Point at the role > View admins
# Confirms who holds it and whether each assignment is OU-limited
5. Repeat for any role your desk staff hold.
Write down what you saw. A simple dated note in the desk wiki is enough:
ROLE CHECK - 2026-11-03 - checked by: j.smith (desk lead)
Role: Help Desk Admin Scope: OU /Staff/London
Privileges seen: Users > Read; Users > Reset password # copy exactly as the console shows
Role: Groups Editor Scope: whole tenant (cannot be OU-limited)
Held by: 2 desk staff
Next check due: after next Google release notes, or 3 months
Gotcha: if you can't open Account > Admin roles, your role doesn't allow you to view roles. That is the system working as designed. Ask the project or a Super Admin to export the list. Don't ask for a bigger role.
The Microsoft side during coexistence
While both systems run side by side, you still need to see Microsoft 365: where mail is routing, sign-in logs, old mailbox settings. Seeing doesn't mean changing. The Entra built-in roles reference (updated 13 October 2026) lists these read-only options:
Global Reader Reads everything a Global Administrator can; updates nothing
Reports Reader Sign-in and audit reports only
Message Center Reader Service messages in Message Center only
For desk staff answering "why can't I sign in to the old Outlook?", Reports Reader is often enough. Global Reader suits the desk lead who needs to see whole configurations. Microsoft flags Global Reader as a privileged role because it can read so much, so hand it out sparingly. Microsoft's Helpdesk Administrator role can still reset passwords. Once users have moved, though, password resets belong on the Google side. Don't keep the Microsoft write access "just in case".
Spotting the ticket you should pass on
Ask three questions:
- Does my role list the privilege? If it doesn't, pass the ticket on.
- Is the target an admin, or outside my OU? If so, pass it on.
- Would the fix change a setting for more than one user? That is tenant-wide policy. Pass it on. Level 3 covers reading tenant-wide policy.
A good escalation note says: who asked, what they need, which privilege it takes, that your role doesn't have it, and who approved the request.
Key takeaways
- Pick the smallest prebuilt role that closes the ticket: Help Desk Admin before User Management Admin, and either of them before Super Admin.
- Only Help Desk Admin and User Management Admin can be limited to an OU. The group roles always cover the whole tenant.
- Only Super Admins reset admin passwords.
- The mailbox owner adds Gmail delegates themselves. Drive ownership transfer needs Drive and Docs plus Data Transfer privileges.
- Check privileges read-only under Account > Admin roles > View privileges, and date your notes.
- On Microsoft during coexistence, prefer read-only roles: Reports Reader, Message Center Reader, and Global Reader for the few who need it.
- When a ticket needs a privilege you don't hold, pass it on with evidence. Don't ask for more access.