How to Share Access to your Google Admin Console

User Management

Home > Google Workspace Handbook > User Management > How to share access to your Google Admin Console

Sharing management access with other users on Google Admin Console is a relatively simple task that doesn’t consume much time to perform. In this guide you will learn why you may want to share access to Google Admin account, how to provide other users in your organization with an administrative role to let them manage users, how to remove super admin privileges, how to add external admins to your Google Workspace.

Why you need to share access to Google Admin console

Sharing Google super admin access with external users is a convenient measure for businesses that want to outsource the issue of Google Workspace management to third-party organizations. Other use cases may include the situations when your IT specialists struggle with some aspects of your Google Workspace management, and the only way to resolve them is to invite external specialists.

How to assign an admin role to existing users

To assign an admin role to the users that already exist in you organization you need to:

Access Google Admin console (admin.google.com) using an account that has the admin privilege.
In the menu on the left go to Directory.
Open Users.
Choose the users you want to promote to an admin role.
Scroll down and click on Admin role and privileges.
Make sure the slider is set to Assigned next to Super Admin role.
Scroll all the way to the bottom and click on Save.

How to remove Google Workspace administrator privileges

Google Admin console allows you to remove Google super admin privileges and revert it back to a normal user status. When the access is removed the selected users won’t be able to access Google Admin console. To remove admin privileges from the selected users follow the steps:

Go to you Google Admin console (admin.google.com).
Locate Directory in the menu on the left.
Click on Users.
Click on the user’s name, who’s admin privileges you would like to remove.
In the opened page scroll down to see the Admin roles and privileges section.
Click the slider to disable the privileges to the selected user.
Scroll all the way to the bottom and hit Save.

How to add an external administrator to Google Workspace

Adding an external administrator to Google Workspace might be useful in different situations, for example, if your organization needs to invite someone to perform admin functions for your Google Workspace.

Some users want to employ their personal emails for Google Workspace management, which is unfortunately not possible. Users with the domains that are different from the domain of your organization cannot be added to your Google Workspace and set as administrators.

The only option to add an unpaid account for strictly super administrator purposes is by using Cloud Identity service

How to use a free Cloud Identity account for Google Workspace administration?

As it has been stated above, there is no option to add a personal account to manage your Google Workspace. However, it’s possible to use Cloud Identity service to create a free unpaid account. This account isn’t licensed for paid Google services, but it may still be used for Google Admin Console. If you want to enable Cloud Identity domain for Google Admin account management, follow the steps below:

Log in to your Google Admin console using a super administrator account.
In the menu on the left locate Billing.
Click on Get more services.
Choose Cloud Identity in the section of categories.
Review the conditions and finish the process.
When the Cloud Identity service is enabled, Google Admin Console may offer you to disable automatic licenses. Make sure it is disabled so that you don’t get charged for the users you create.
Create a new account. Ensure it doesn’t have Google license assigned.
Assign an admin role to the created user.
Depending on your needs you can remove super admin privileges from the other accounts.

Keep in mind that using Cloud Identity service won’t allow you to create a separate domain for the external users. You will have to stick to the standard domain that you already have. The best advantage of this approach is that you don’t have to pay for the user’s license.

How to use a 'secondary domain' for Google Workspace administration?

The use of secondary domains might also serve as an alternative option for external users. Especially when you there is a requirement to use a different domain for the new users. Bear in mind that in comparison with the previous solution this approach is relatively limited. On top of that, it requires more time and money.

To set up secondary domain for Google Workspace, you can follow the steps:

Log in to your Google Admin console using an account that has Admin privilege.
In the menu on the left locate Account.
Open Domains.
Click on Manage domains.
In the opened page, you can see all the existing domains that belong to your Google Workspace.
Click Add a domain in the top menu.
Enter a domain name.
Select a domain type.
Hit Add domain & start verification.
Now, when you have a secondary domain, you can create users using it.

Even though the official Google documentation states that you can manage separate of users or business at different domains, you should remember that your primary domain will be billed for the services that used by other domains. Moreover, you are not allowed to set up a separate billing address or a company logo for a secondary domain

Overall, the use of secondary domains isn’t worth the effort since the behavior of secondary domains in Google Admin console is also quite questionable.

Common Issues and Troubleshooting

When sharing access to your Google Admin Console, you might encounter some common issues. Here are a few and how to troubleshoot them:

Access Denied Errors

Issue: The user receives an “Access Denied” error when trying to log in.

Troubleshooting: Ensure the user has been granted the correct permissions. Double-check the role assigned to them in the Admin Console and verify that their email address is correct.

Permission Conflicts

Issue: Users have conflicting permissions that prevent them from performing certain actions.

Troubleshooting: Review the roles and permissions assigned to each user. Adjust the roles to ensure there are no overlaps or conflicts that could restrict access.

Two-Factor Authentication (2FA) Problems

Issue: Users are unable to complete the 2FA process.

Troubleshooting: Verify that the user’s 2FA settings are correctly configured. Ensure they have access to their authentication method (e.g., mobile device, authentication app) and that it is properly set up.

Account Lockouts

Issue: Users are locked out of their accounts after multiple failed login attempts.

Troubleshooting: Reset the user’s password through the Admin Console. Advise the user to use a strong, unique password and to ensure they are entering it correctly.

Email Delivery Issues

Issue: Users are not receiving invitation emails to access the Admin Console.

Troubleshooting: Check the email address for typos and ensure the invitation email was sent. Ask the user to check their spam or junk folder. Resend the invitation if necessary.

Role Assignment Errors

Issue: Users are assigned incorrect roles or permissions.

Troubleshooting: Review the roles and permissions assigned to the user. Correct any mistakes and ensure the user has the appropriate level of access for their responsibilities.

Synchronization Problems

Issue: Changes made in the Admin Console are not reflecting for users.

Troubleshooting: Ensure that the changes have been saved and that there are no delays in synchronization. Check for any ongoing issues with Google’s services that might affect synchronization.