Who controls your Google Workspace? Super admins, explained.
Google Workspace doesn't have an "account owner" the way Shopify or Stripe does. Control is a role — super administrator — and whoever holds it can create and delete users, read and reset anything, change billing, and grant or revoke the role itself. Combined with control of your domain's DNS, super admin *is* ownership.
Which makes the audit question simple and urgent: which humans hold super admin today, and does the business control those accounts? Here's how to check and fix it, per Google's own documentation.
Check who holds super admin (two minutes)
Sign in to the Admin console (admin.google.com) — if nobody in the business can, skip straight to our recovery guide — and open Directory → Users. Admin roles are listed on each user's account page under Admin roles and privileges; the Admin roles section of the console shows every role and its assignees in one place.
You're looking for two failure modes: only one super admin (key-person risk), or a super admin who shouldn't be one — a former employee, an external IT contractor's personal account, the founder's old Gmail-forwarded identity.
Grant the role to a second person
- 1Directory → Users, select the userPick an account the business durably controls — on your domain, not a personal address.
- 2Open Admin roles and privilegesOn the user's account page.
- 3Assign Super AdminToggle the Super Admin role to Assigned and save.
- 4Add recovery info to both admin accountsRecovery phone and email on every super admin — it's what makes account recovery possible without drama.
Remove it from someone who shouldn't have it
- 1Confirm you have a second super admin firstNever remove the last working super admin — that's how businesses end up in the recovery flow.
- 2Directory → Users → their account → Admin roles and privilegesYou must be signed in as a super admin yourself.
- 3Revoke the roleToggle the assignment off. If they're leaving the company entirely, follow the full offboarding checklist — the admin role is rarely their only entanglement.
Set it up properly
- At least two super admins (Google's guidance: don't depend on one), held by different people in the business.
- Delegate day-to-day tasks with Google's prebuilt lesser roles — user management, help desk, groups — instead of handing out super admin.
- External IT gets a delegated role on an account you can see and revoke, never the only super admin seat.
- Record the super admins in your asset register and re-check on every departure.
The free scan maps your domain, email, cloud, social and tools from public records — and shows what you'd lose access to tomorrow. No login, nothing to install.
Check my business