# Mandatory Administrator Privileges for Google Workspace Integration Google Workspace is a cloud-based platform that provides businesses and organizations with a suite of collaboration tools. Integrating Google Workspace with Hexnode streamlines device enrollment and enhances user management within the UEM. To effectively manage Google Workspace integration, specific administrative roles and privileges are required, which define the level of access within the Google Admin Console and API. This document will guide you with the necessary roles and privileges necessary for Google Workspace integration with Hexnode. Necessary roles and privileges for Google Workspace integration --------------------------------------------------------------- Integrating Hexnode with Google Workspace requires administrative access to manage users, devices, and security settings. This can be achieved by either assigning the **Super Admin** role or creating a **custom admin role** with the necessary privileges in the [Google Admin Console](https://admin.google.com/). ### Super Admin Role The Google Workspace Super Admin holds the highest level of administrative control to all settings and resources within the organization. This role is required for Google Workspace integration with Hexnode, as it allows full control over user management, security configurations, API access, and domain-wide settings. Without this level of access, certain integration features may not function. ### How to assign super admin role? 1. Log in to the [Google Admin Console](https://admin.google.com/). 2. Navigate to the **Users** section. 3. Click on the user’s name from the list of users. 4. Go to **Admin roles and privileges**. 5. Toggle the **Super Admin** role to **Assigned** by clicking the slider. 6. Click **Save** to apply the changes. [![Assigning super admin role in Google Admin console for Google Workspace integration.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2025/12/Assigning-super-admin-role-in-Google-Admin-console.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2025/12/Assigning-super-admin-role-in-Google-Admin-console.png "Assigning super admin role in Google Admin console") Note: Changes made in the Admin console may take up to 24 hours to take effect. ### Create custom admin role While the **super admin** role provides full administrative control, it may not always be the best choice due to security concerns. Granting **super admin** access to multiple users can increase security risks if not properly managed. Instead, organizations can create a **custom admin role** with only the required privileges for Google Workspace integration. A custom admin role lets you adjust the administrative privileges to match specific tasks and responsibilities, ensuring each user has the right level of access for their role. For Google Workspace integration with Hexnode, the following **Admin console privileges** and **Admin API privileges** are necessary: **Admin console privileges:** CategoryPrivilege NameUse**1. Organizational Units**- Organizational Units > Read This privilege in Google Workspace allows administrators to view and manage the organizational structure of their account from the Users page in the Admin console. **2. Users**- Users > Read - Users > Create - Users > Update - Users > Update > Move Users - Users > Update > Suspend Users - Users > Update > Rename Users - Users > Update > Reset Password - Users > Update > Force Password Change - Users > Update > Add/Remove Aliases - Users > Delete The Users privilege in Google Workspace grants administrators the ability to manage user accounts within the organization. **3. Groups**The Groups privilege in Google Workspace grants administrators full control over groups created within the Admin console. **4. Domain Settings**The Domain Settings privilege in Google Workspace grants administrators the ability to manage key aspects of their organization’s account settings such as adding/removing domains, domain aliases, change the organization name, logo etc. **5. Security**- Security > User Security Management The Security privilege in Google Workspace allows administrators to manage security settings for individual users.**Admin API privileges:** CategoryPrivilege NameUse**1. Manage Customer**- Manage customer > Read customer > Read customer branding settings - Manage customer > Read customer > Read customer onboard settings - Manage customer > Read customer > Read customer profile settings - Manage customer > Read customer > Read customer support settings - Manage customer > Read customer > Read customer timezone settings - Manage customer > Update customer > Update customer branding settings - Manage customer > Update customer > Update customer onboard settings - Manage customer > Update customer > Update customer profile settings - Manage customer > Update customer > Update customer support settings - Manage customer > Update customer > Update customer timezone settings The Manage Customer privilege allows administrators to read and update customer-related settings within the Admin Console. **2. User Security Management**The User Security Management privilege in Google Workspace grants administrators the ability to manage security settings for individual users.**3. Billing Management**- Billing Management > Billing Read The Billing Management privilege Google Workspace allows administrators to manage billing tasks within the Admin Console. **4. Domain Management**The Domain Management privilege allows administrators to add, remove, and configure domain aliases within the system.**5. Groups**- Groups > Create - Groups > Delete - Groups > Read - Groups > Update The Groups privilege in Google Workspace grants administrators full control over groups created within the Admin console. Admins can perform all the operations granted by the Groups Admin console privilege. **6. Manage locked label on groups resources**The locked label privilege allows administrators to lock or unlock groups within the system. **7. Add security label on groups resource**The security label privilege allows administrators to add a security label to a group, enabling the control of access to sensitive information and resources. **8. Organization Units**- Organization Units > Read This privilege in Google Workspace allows administrators to view and manage the organizational structure of their account from the Users page in the Admin console. Admins can perform all the operations granted by the Organizational Units Admin console privilege. **9. Users**- Users > Create - Users > Delete - Users > Read - Users > Update Custom Attributes - Users > Update - Users > Update > Add/Remove Aliases - Users > Update > Force Password Change - Users > Update > Move Users - Users > Update > Rename Users - Users > Update > Reset Password - Users > Update > Suspend Users The Users privilege in Google Workspace grants administrators the ability to manage user accounts within the organization. Admins can perform all the operations granted by the Users Admin console privilege. Note: When an admin is granted privileges in the Admin console, they receive the same level of access in the API. For example, if they have permission to create users in the Admin console, they can also do so through the API. Likewise, changes made to Admin API rights reflect in the Admin console privileges. ### How to create a custom role? Note: Only Super Administrators have the privilege to create custom roles within the Admin Console. 1. Log in to the [Google Admin Console](https://admin.google.com/). 2. In the Admin console, navigate to **Menu > Account > Admin roles**. 3. Click on **Create new role**. 4. Enter a **name** and, optionally, a **description** for the role and click **Continue**. 5. Select the desired privileges from the **Privilege Name** list by checking the appropriate boxes. 6. Click **Continue** to proceed. 7. Review the selected privileges and click **Create Role**. 8. Assign the custom role to the user. [![Creating custom role in Google Admin console for Google workspace integration ](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2025/12/Create-custom-role-in-Google-Admin-console.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2025/12/Create-custom-role-in-Google-Admin-console.png "Create custom role in Google Admin console")