Lesson 2: Who Can Do What: The Smallest Role for Each Job

Why this lesson exists

On a help desk you get asked to borrow the super admin account all the time. A ticket comes in ("a supplier's invoice never arrived") and the fastest-looking fix is to log in as admin@ and dig around. Don't do it. A super admin account can delete every user, read every setting and switch off every service. If the session gets phished, or you misclick, the whole tenant suffers. If you only hold the privileges the job needs, a mistake can only do that much damage.

This lesson connects the everyday mail and calendar jobs to the smallest role that can do each one. What follows was checked against Google's admin help in November 2026. Google renames privileges and moves screens, so re-check in your own tenant before you rely on any name below.

Where roles live, and how to read one

There are two building blocks:

• Prebuilt roles: bundles Google maintains, such as Help Desk Admin, User Management Admin, Groups Admin and Services Admin.
• Custom roles: a super admin ticks individual privileges from a list. Only a super admin can create a custom role.

Read-only check first. Find out what you hold and what each role allows:

Admin console (admin.google.com)
  Menu > Account > Admin roles          # lists every prebuilt and custom role
    click a role > Privileges tab       # the exact boxes ticked
    point at a role > Assign admin      # Admins tab: users, groups, service accounts holding it

  Menu > Directory > Users > (your own account)
    > Admin roles and privileges        # what YOU hold, and the scope of each role

In the Privileges tab, privileges are grouped under Admin console privileges (Users, Groups and so on) and Services (Gmail, Calendar and so on). Read it the way you'd read a firewall rule: anything not ticked is not allowed.

The job-to-privilege map

Notice what's missing: Help Desk Admin cannot search email logs or touch quarantine. People assume it can. It resets passwords and shows you profiles and the org structure, nothing more.

Gotcha: scope. Only roles that contain at least one Users privilege can be limited to org units. When you assign the role, you see Edit next to "All organizational units". Gmail and Calendar privileges always apply to the whole tenant. Email Log Search shows you messages for everyone, including the CEO. That's why it's often given to second line rather than first.

Worked example: writing the role request

You're second line at a 400-person firm. First line is going to handle the UK office (/Staff/UK) and keep asking you for log searches. Your super admin wants a request in writing. Split it into two roles, so the scoped privileges and the tenant-wide ones never get mixed:

To: IT Security (super admins)
Subject: Custom admin roles for Service Desk – least privilege

Role 1: "SD – UK User Support"
  Admin console privileges > Users:
    [x] Read                # look up the user on a ticket
    [x] Reset password      # most common first-line job
    [x] Force password change
  Scope: org unit /Staff/UK only (Edit next to "All organizational units")
  Assign to: security group sd-uk@ (not a dynamic group)

Role 2: "SD – Mail Tracing"
  Services > Gmail:
    [x] Email Log Search    # delivery tickets; tenant-wide, cannot be OU-scoped
  NOT requested: Gmail Settings, Access Admin Quarantine
  Assign to: named second-line staff only

Justification: ~30 password and ~15 "missing email" tickets a week now
wait for a super admin. Neither role can change policy or touch admins.
Review date: 6 months.

The request names each privilege exactly as the console shows it. It says what you are not asking for and why the scope is what it is. It also sets a review date. Requests written like this get approved. "Can I have admin?" requests get refused.

Best practice: assign roles to a security group, not to individuals. Then joiners and leavers are just a group-membership change. You can't assign Super Admin to a group, and dynamic groups aren't allowed.

When the ticket needs more than you hold

The symptom is easy to spot: the menu item isn't there, a page is greyed out, or you get "You don't have access". The wrong fix is borrowing a colleague's login or the shared admin@ password. That breaks the audit trail, and many firms treat it as a disciplinary matter. The right move:

1. Confirm: Directory > Users > you > Admin roles and privileges   # is it really missing?
2. Note the privilege the task needs (use the map above)
3. Hand over the ticket: user, message ID or time window, what you checked,
   the privilege required
4. Tell the user: "This needs a specialist permission; it's with the
   mail team, reference #1234."

If the same job keeps getting escalated, that's evidence for a role request like the one above.

Key takeaways

• Roles live at Menu > Account > Admin roles. Read the Privileges tab, and remember anything not ticked is not allowed.
• Help Desk Admin resets non-admin passwords. It does not include Email Log Search or quarantine.
• Email Log Search, Access Admin Quarantine and Calendar resource privileges are custom-role privileges, and they apply to the whole tenant.
• Only roles that contain Users privileges can be scoped to org units.
• Only super admins create roles. Write a precise, two-role request and assign it to a security group.
• Missing a privilege? Escalate with evidence. Never borrow an account.