Google Workspace Support Pro: Admin Console, Roles and Triage

What's inside

1. Level 1: Google Workspace on One PageFree
   Learn what a Workspace user actually sees (Gmail, Calendar, Drive, Meet, Chat) and what sits behind it (the tenant, primary and secondary domains, the directory, licences and the Admin console), and why this course is independent of Google and checks every screen against Google's current help pages, now on knowledge.workspace.google.com, with the date checked.
2. Level 2: Editions, Subscriptions and Licences for SupportFree
   Read the tenant's subscriptions and licence counts from Billing in the Admin console, and learn why the edition a user is licensed for decides which features, limits and support entitlements apply to their ticket.
3. Level 3: Touring the Admin Console Safely
   Get around the Admin console (admin.google.com): the home page, the search bar, and the Directory, Devices, Apps, Security, Reporting and Account areas. Learn the habits that keep a support session read-only until a change is actually intended.
4. Level 4: Reading a User's Account Page
   Learn to read a user's detail page under Directory > Users the way support does: status, organisational unit, last sign-in, licences, 2-Step Verification enrolment, groups, aliases and admin roles, so you can rule causes in or out before touching anything.
5. Level 5: Organisational Units and Inheritance
   Learn how the organisational unit (OU) tree works, how child OUs inherit settings from their parent unless they override them, and why a user's OU is often the hidden reason a feature behaves differently for them.
6. Level 6: Groups as Support Sees Them
   Learn the jobs groups do in a tenant (mailing lists, sharing targets, security groups and configuration groups used to apply settings) and see that the Admin console and the Google Groups app show different views of the same group.
7. Level 7: Service Settings: Reading the Effective Policy
   Learn to find which setting actually applies to a user when a service setting is applied to the whole organisation, to an OU and to a configuration group, how to tell an inherited value from an overridden one, and how long changes can take to reach users.
8. Level 8: How Admin Roles Work
   Learn how Workspace admin access is built from privileges collected into roles and assigned to users, and why giving every support person super admin is a risk to the tenant, not a convenience.
9. Level 9: Help Desk Admin and the Reader Roles
   Learn what the prebuilt Help Desk Admin role can and cannot do (reset passwords for non-admin users, view profiles and the OU structure) and how read-only roles such as Groups Reader cover most first-line lookups.
10. Level 10: User Management, Groups and Services Admins
    Compare the prebuilt roles that second line staff usually need (User Management Admin, Groups Admin, Services Admin) and match each to the jobs it allows, including what each one is deliberately prevented from doing.
11. Level 11: Limiting a Role to an Organisational Unit
    Assign roles such as Help Desk Admin and User Management Admin so they apply only to one OU. This lets a site or departmental support team manage its own users without reach into the rest of the tenant.
12. Level 12: Custom Roles for Specific Support Jobs
    Build a custom admin role that holds only the privileges one support job needs, for example reading users and groups and viewing reports, and review that role and who holds it over time.
13. Level 13: Creating a New User Account
    Create a user in Directory > Users. Begin with read-only checks (is the name or address already taken by a user, group or alias, is a licence free, which OU should they go in), then set the first-sign-in password policy and hand the account over securely.
14. Level 14: Assigning and Changing Licences
    Assign, change and remove a user's licence. Learn how automatic licensing interacts with manual assignment, what the user loses when a licence is removed, and how to check that the new entitlement has taken effect.
15. Level 15: Moving a User Between Organisational Units
    Move a user to a different OU after first comparing the settings that apply in the source and target OUs, so a transfer between departments or sites doesn't quietly switch off a service the user relies on.
16. Level 16: Aliases, Alternate Addresses and Renames
    Add and remove email aliases, and rename a user's primary address after a name change. Learn what happens to the old address and why the address you want can clash with an existing group or alias.
17. Level 17: Managing Group Membership
    Add, remove and change members and their roles (member, manager, owner) in a group from the Admin console, and check what that change does to the person's mail and access before you make it.
18. Level 18: Gmail Delegation
    Set up and remove Gmail mailbox delegation. First check whether delegation is allowed for the user's OU, then learn what delegates can and cannot do and how delegation differs from forwarding and from sharing a group inbox.
19. Level 19: Shared Drive Access
    Add and remove people on a shared drive and choose the right access level. First check the shared drive settings and the Drive policy for the user's OU, which can stop you adding certain people.
20. Level 20: Password Resets and 2SV Recovery
    Reset a user's password and recover a 2-Step Verification (2SV) lockout with backup verification codes, after first confirming who the caller is and checking whether the account is an admin, which your role may not let you reset.
21. Level 21: Suspending a User: Stop Access, Keep the Data
    How to read an account's state, then suspend it or bring it back from Directory > Users, knowing what stops at once and what does not: open sessions, mobile sync, app passwords, mail delivery and licence billing, each checked against Google's current help pages and dated.
22. Level 22: Full Offboarding: Data Transfer, Then Delete Safely
    An offboarding run you can repeat: confirm approval, check for Vault holds and anything the person owns, transfer Drive, Calendar and other data to the right owner, deal with mail and groups, and delete only after every check passes, inside the window in which a deleted user can still be restored.
23. Level 23: Fault: User Cannot Sign In
    The sign-in fault pattern: symptom, likely causes in order (wrong account or typo, suspended account, password expired or reset needed, licence or OU change, SSO or context-aware access policy), the check, the fix, how to confirm it worked, and what to tell the user.
24. Level 24: Fault: 2-Step Verification Lockout
    Diagnosing a user locked out by 2SV, such as a lost phone, a new handset, a missing security key or an enforcement date that has passed, and choosing between backup codes and a temporary exemption, with identity checked before anything is handed over.
25. Level 25: Fault: Mail Not Arriving
    Working through 'I never got the email': the user's own filters and forwarding, spam and quarantine, routing and compliance rules, then delivery from outside, with Email Log Search as the deciding check.
26. Level 26: Fault: Mail Bouncing Back to the Sender
    Reading non-delivery reports for both outbound and inbound bounces: the address doesn't exist, mailbox or sending limits, SPF, DKIM or DMARC authentication failures, and blocks set by policy, with each one tied to the place where it can be checked.
27. Level 27: Fault: Drive Sharing Blocked
    Why a user can't share or open a file: sharing settings for their OU, trust rules or allowlisted domains, shared drive settings and member access levels, ownership, and labels or data-protection rules, each read so you can explain it, not change it.
28. Level 28: Fault: Calendar Problems
    Diagnosing the usual Calendar tickets: meetings that never arrive or show at the wrong time, free/busy not visible, delegate and room booking problems, and invitations to external people, separating the user's settings from tenant-wide sharing settings.
29. Level 29: Fault: Meet Call and Join Problems
    Fixing Meet faults in order: wrong account or no licence, external people or guests blocked by policy, recording or other features missing for the user's edition, then the user's network, browser and devices, using Meet quality data as the evidence.
30. Level 30: Fault: Service or App Missing for a User
    The 'I don't have Gmail, Drive or an app' ticket: no licence or the wrong one, the service turned off for the user's OU or group, a recent move between OUs, settings that are still taking effect, and a mismatch between edition and feature.
31. Level 31: Fault: Group Mail Not Delivered
    Diagnosing group delivery: who is allowed to post, whether outsiders can post, messages held for moderation, each member's delivery setting, nested groups, and spam handling, read on the group's own settings page and in Email Log Search.
32. Level 32: Fault: Mobile and Device Sync Failures
    Why a phone or laptop stops syncing: the device is unapproved or blocked, basic versus advanced management, a work profile or passcode not meeting requirements, a wipe or a sign-out, or an account problem, all checked from the device's page.
33. Level 33: Reading Tenant-Wide Policy to Explain an Effect
    A method for any 'why does it do that' ticket: find which OU and group the user sits in, follow how settings are inherited and overridden, read the setting that actually applies and the admin log change that set it, then explain it and escalate rather than change it.
34. Level 34: Workspace Status Dashboard: Is It Google?
    Using the public Workspace Status Dashboard and any service alerts in the Admin console to decide quickly whether a ticket belongs to a Google-side incident, and how to handle users while it is going on.
35. Level 35: Audit and Investigation Logs Support Can Read
    A tour of Reporting > Audit and investigation from support's point of view: the admin, user, Drive, Gmail, Calendar, Meet and device log events, how to filter them and export a result, how long data takes to appear and how long it is kept, and which features (such as the security investigation tool) depend on the edition.
36. Level 36: Email Log Search in Depth
    Getting the most out of Email Log Search: search fields, time ranges, message states, reading the per-hop routing and authentication details, and what to hand on when a result points to a routing, spam or DNS problem.
37. Level 37: The Google Support Route and What Your Tier Gets
    How to open and manage a case through the Admin console's help and support option, who is allowed to contact Google, the P1 to P4 priority definitions, and the response targets for Standard, Enhanced and Premium Support, verified on Google's current support guidelines and dated.
38. Level 38: Ticket Severity and Triage
    Triage that holds up under pressure: weighing impact against urgency, how many users are affected, security warning signs, whether a workaround exists, and whether the ticket goes to a Google incident, a policy owner, third line or yourself, plus how duplicates and clusters reveal a wider fault.
39. Level 39: Building the Evidence Packet
    Putting together an escalation that third line or Google can act on straight away: a clear problem statement, affected users and their OUs, timestamps with time zone, steps to reproduce, log exports, message headers and IDs, what you've already ruled out, and the business impact.
40. Level 40: Final Challenge: The Mixed Ticket Queue Exam
    A realistic queue of mixed Google Workspace tickets covering lockouts, bounces, sharing blocks, missing services, a leaver, a possible Google incident and a policy request, each to be triaged, resolved or escalated with a written note, using the smallest role and read-only checks first.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →