6 Super-admin separation & minimal count

Caveats

• Prebuilt delegated roles cannot manage any administrator account¹
• Google is phasing in mandatory 2SV for admin accounts (currently enforced for Education,…²
• Do not delete the last super admin, and keep the break-glass account (№20) out of this cleanup entirely

Setup steps

1. open ↗

   

   https://admin.google.com/ac/roles/65252159033180161/admins · captured 2026-07-15

   Account › Admin roles › Super Admin ↗

   Open the Super Admin role and list its assignees. Count them.

   Super admins

   2–4 named humans, no more

   Assign specific admin roles ↗

2. open ↗

   

   https://admin.google.com/ac/users · captured 2026-07-15

   Directory › Users ↗

   For each human who needs admin rights, create a dedicated admin identity separate from their mail-reading daily account.

   admin-<name>@<domain>, no mail flow, no third-party OAuth grants

   Make a user an admin ↗

3. open ↗

   

   https://admin.google.com/ac/list/roles · captured 2026-07-15

   Account › Admin roles ↗

   Downgrade day-to-day accounts to the narrowest prebuilt role that does their job (User Management, Help Desk, Services), and revoke Super Admin from them.

   Daily accounts

   delegated role only

   Super Admin

   admin-* identities

   Prebuilt administrator roles ↗ Remove Google Workspace administrator privileges ↗

4. Account › Admin roles › <role> › Admins

   Record the roster in the register (№5) and set a recertification date (№41).

   Roster exported and dated

Ongoing maintenance

• automatable: script Quarterly: re-run the super-admin enumeration and re-attest each entry (folds into the №41 recertification cycle).

How to verify

1. Count the super admins and check they are dedicated admin-only identities (no mail flow, no OAuth grants).

   gam print users query "isAdmin=true" fields primaryEmail,lastLoginTime

2. The list should be 2–4 accounts, every one a dedicated admin identity — a daily-driver mailbox in this list is the finding.