Admin rights that switch themselves off
In the Admin console, you can now give someone an administrator role for a limited time: on the chosen date, Google removes it automatically. No more ‘temporary’ rights forgotten for years.
A contractor coming in for an audit, a colleague covering for the administrator while they’re on holiday, a three-month migration project… In each case, someone gets administrator rights ‘for a while’. And in many companies, those rights are still there two years later, because nobody remembered to take them away.
What’s changing
In the Google Admin console, an administrator role can now be assigned with an expiry date. On that day, at the chosen time, Google removes the role automatically. Nobody has to remember.
In practice:
- the duration takes two clicks: 1 day, 7 days, 30 days or 90 days, or a specific date and time, up to one year ahead;
- it works for everyone: a user, a group or a service account;
- it’s available now, for all Google Workspace customers;
- only a super admin can set these dates;
- the primary admin is left out: their super admin rights stay permanent, by design.
Licences affected: all Google Workspace editions.
Why it matters
Every administrator account is a way in. If its password is stolen, the attacker gets all of its rights. The fewer administrators you have, and the shorter they keep those rights, the fewer doors there are to watch.
Until now, removing a temporary right relied on someone’s memory, or on a reminder in a calendar. From now on, the date does the work.
Our view
It’s a small box on a screen few people open, but it’s one of the most useful security updates of the year. Three habits to start now:
- review your current administrators. In ‘Admin roles’, check who has which rights and ask, for each one: do they still need them? Those that were meant to be ‘temporary’ can be given an end date today;
- give every one-off right an end date. Contractor, cover, audit: the end date is decided when access is granted, not afterwards;
- grant the right role, not the biggest one. A limited role (managing users or groups, for example) is often enough. Keep super admin for one or two people.
Want to know who really holds the keys to your Google Workspace? Let’s talk.