# Super admin count is restricted to 2 or fewer

- Source: https://support.icompaas.com/support/solutions/articles/a_1781206639525200-super-admin-count-is-restricted-to-2-or-fewer
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Identity Provider (IDP)](https://support.icompaas.com/support/solutions/c_1781206270516942) › [Google Workspace](https://support.icompaas.com/support/solutions/folders/f_178120654326249)
- Last updated: 2026-06-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:  
This control ensures that the number of Google Workspace Super Administrator accounts is restricted to two or fewer. Limiting the number of Super Administrators reduces the risk of unauthorized changes, privilege misuse, and account compromise while maintaining sufficient administrative coverage.

  

Rationale:  
Super Administrators have unrestricted access to all Google Workspace settings, users, and services. Restricting the number of Super Administrators helps enforce the principle of least privilege, reduces the attack surface, and improves accountability for administrative actions.

  

Impact:

-   Reduces the risk of unauthorized administrative changes.
    
-   Limits exposure of highly privileged accounts.
    
-   Improves accountability and administrative oversight.
    
-   Supports compliance requirements related to privileged access management.
    
-   May require the use of delegated administrative roles for routine administrative tasks.
    

  

Default Value:  
Not restricted by default. Organizations must manually limit the number of assigned Super Administrator accounts.

  

Remediation

Test Plan

1.  Sign in to the Google Admin console with administrative privileges.
    
2.  Navigate to Directory → Users.
    
3.  Filter or review users assigned the Super Admin role.
    
4.  Count the total number of users assigned the Super Admin role.
    
5.  Verify that no more than two users are assigned the Super Admin role.
    
6.  If more than two users are assigned the Super Admin role, follow the Implementation Steps to remediate the issue and repeat the test.
    

  

Implementation Steps:

1.  Sign in to the Google Admin console with Super Administrator privileges.
    
2.  Navigate to Account → Admin roles.
    
3.  Select the Super Admin role.
    
4.  Review the list of users assigned to the role.
    
5.  Identify any users who do not require Super Administrator privileges.
    
6.  Remove the Super Admin role from users exceeding the approved limit.
    
7.  Assign lower-privileged administrative roles as required for operational responsibilities.
    
8.  Ensure that no more than two users retain the Super Admin role.
    
9.  Save the configuration changes if prompted.
    
10.  Verify that the total number of Super Administrators is two or fewer.
     

  

Backout Plan:

1.  Sign in to the Google Admin console with Super Administrator privileges.
    
2.  Navigate to Account → Admin roles.
    
3.  Select the Super Admin role.
    
4.  Assign the role to additional authorized users as required.
    
5.  Save the configuration changes if prompted.
    
6.  Verify that administrative access functions according to the updated configuration.
    

  

References:

-   [Google Workspace Administrator Roles Documentation  
    ](https://support.google.com/a/answer/2405986)[Google Workspace Assign Administrator Roles Documentation](https://support.google.com/a/answer/172176)
    
-   [Google Workspace Security Best Practices Documentation  
      
    ](https://support.google.com/a/answer/7587183)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.