Super Admin Service Account

[MedonQ]

__25.09.2021__

MedonQ

Hello People, 

I have a question for the concern in using an account as Service Account with Super Admin Privileges that is 

a part of the main Super Admin to be implementable as a thread occurs to enter into your Admin Console without 

the need to create another extra account for that term. Now you will pay for another account to implement it so, 

but I think the security needs to be considered, and the activity that is with such an account related to. 

Therefore to implement these as an integrative to be used, is intelligent and a good care for the foreseeing in 

peoples own security. 

Is their something in consideration to make Super-Admin Service Account a permanent part of the main account to the admin console?

[KAM]

@MedonQ Some of your English is a little rough but I think this covers your question.

It is a best practice under Principle of Least Privilege (PoLP) to improve security by using separate accounts for day to day and administrative work. 

To save on costs, in Google Workspace, in Billing, you might be able to enable and leverage the free Cloud Identity product to facilitate this.

NOTE: When you enable cloud identity, your control over session length company wide may be impacted allowing only the default of 14 days. Additionally, if you want, you can have google default to licensing only for Cloud Identity. When you add new users, you have to remember to give them a Workspace license.

Now that you have Cloud Identity available, you can create an account such as medonq.SUPERADMIN in Workspace but assign it only the cloud identity license. Then downgrade your existing SuperAdmins to normal accounts.  Now medonq, can use your account as normal but when you need to perform admin work, you use another Chrome profile for the SUPERADMIN account.

All superadmins should be in a single OU with the most stringent policies for protection such as longer passwords, mandatory 2SV, etc.

NOTE: With cloud identity, you cannot do email and there might be services needed that require it so Cloud Identity might not be a solution in all situations for all customers however a separate account is still best practice with the costs incurred.

Hope this helps, KAM