Super admins in Google Workspace: security best practices

By the QuantumSec team

The super admin account is the master key to your Google Workspace: it accesses everything, changes any setting and creates or deletes users. It's also the most coveted target for an attacker. Managing it well is one of the most important security decisions in your environment.

How many super admins you should have

The CIS Benchmark recommends two or fewer. Too many super admins multiply the attack surface of the most valuable accounts; having just one, on the other hand, exposes you to being locked out if that account is lost. The usual balance is two accounts, strongly protected and monitored.

Separate admin accounts from day-to-day accounts

A super admin shouldn't use that same account to read email or browse daily. It's advisable to have dedicated admin accounts, with no everyday use, so that phishing a normal employee account never compromises admin privileges.

Least privilege with delegated roles

Not the whole IT team needs to be a super admin. Google Workspace lets you create delegated admin roles (user management, help desk, group management, etc.) that grant only the necessary permissions. Applying least privilege drastically reduces the impact if one of those accounts is compromised.

Enhanced protection of admin accounts

Protect every admin account with security keys or passkeys, enroll them in the Advanced Protection Program and configure alerts for privilege changes. Periodically review who holds admin roles and remove those no longer needed.

FAQ

Why not use a single super admin account for everything?

For two reasons: if that account is lost or locked, you're left without admin access; and if it's compromised, the attacker controls everything. The recommendation is two protected accounts and delegated roles for the rest of the team.

How do I detect if new admins are created without authorization?

By configuring alerts in the admin console for privilege changes and reviewing the audit logs. The creation of a new super admin is one of the events that should always trigger an alert.