# 6 Super-admin separation & minimal count

> v0.1.2 · role: Prevent · [policy: #4 · #28](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

Super admin is the tenant's root privilege: it can read any mailbox, reset any password and unwind any setting on this list. This control caps the number of super admins at a handful and — the part that matters more — moves the role onto dedicated admin-only identities with no mail flow and no third-party OAuth grants, so an admin's daily phishing exposure is not also the tenant's. Everyday accounts drop to the narrowest prebuilt delegated role that does their job.

Documentation: [Security best practices for administrator accounts](https://knowledge.workspace.google.com/admin/users/security-best-practices-for-administrator-accounts)

## Caveats

- Prebuilt delegated roles cannot manage any administrator account — only a super admin can reset an admin's password or assign admin privileges. Custom roles are different: a custom role that can reset another admin's password or assign roles escalates stepwise to super admin, so check the privilege set of every custom role.
- Google is phasing in mandatory 2SV for admin accounts (currently enforced for Education, Nonprofits, Cloud Identity, Android Enterprise and Enterprise editions using third-party SSO, with more to follow) — enrol the new admin-* identities before you assign the role; once enforcement applies, an unenrolled admin loses mobile access at day 15 and web access at day 30.
- Do not delete the last super admin, and keep the break-glass account (№20) out of this cleanup entirely.

## Setup steps

1. Open the Super Admin role and list its assignees. Count them. — `Account › Admin roles › Super Admin`

   - **Super admins** = 2–4 named humans, no more

   docs: [Assign specific admin roles](https://knowledge.workspace.google.com/admin/users/assign-specific-admin-roles)

2. For each human who needs admin rights, create a dedicated admin identity separate from their mail-reading daily account. — `Directory › Users`

   admin-<name>@<domain>, no mail flow, no third-party OAuth grants

   docs: [Make a user an admin](https://knowledge.workspace.google.com/admin/users/make-a-user-an-admin)

3. Downgrade day-to-day accounts to the narrowest prebuilt role that does their job (User Management, Help Desk, Services), and revoke Super Admin from them. — `Account › Admin roles`

   - **Daily accounts** = delegated role only
   - **Super Admin** = admin-* identities

   docs: [Prebuilt administrator roles](https://knowledge.workspace.google.com/admin/users/prebuilt-administrator-roles) · [Remove Google Workspace administrator privileges](https://knowledge.workspace.google.com/admin/users/remove-google-workspace-administrator-privileges)

4. Record the roster in the register ([№5](account-inventory.md)) and set a recertification date ([№41](access-recertification.md)). — `Account › Admin roles › <role> › Admins`

   Roster exported and dated

## Ongoing maintenance

- **[automatable: script]** Quarterly: re-run the super-admin enumeration and re-attest each entry (folds into the [№41](access-recertification.md) recertification cycle).

## How to verify

1. Count the super admins and check they are dedicated admin-only identities (no mail flow, no OAuth grants).

   ```
   gam print users query "isAdmin=true" fields primaryEmail,lastLoginTime
   ```

2. The list should be 2–4 accounts, every one a dedicated admin identity — a daily-driver mailbox in this list is the finding.

## Settings screens

- Account > Admin roles > Super Admin
  - console: https://admin.google.com/ac/roles/65252159033180161/admins
  - screenshot: ../screenshots/admin.google.com/ac/roles/65252159033180161/admins.png
- Account > Admin roles
  - console: https://admin.google.com/ac/list/roles
  - screenshot: ../screenshots/admin.google.com/ac/list/roles.png
- Directory > Users (create the separate admin identity; verify no daily-driver account is an admin)
  - console: https://admin.google.com/ac/users
  - screenshot: ../screenshots/admin.google.com/ac/users.png