Admin Console Access (Possibly Read Only) for Technology Staff

[Bill_Gibson]

Currently we limit GAC access to a small set of our senior technology staff.
Other technology roles have access to platforms that ingest data from GWfE and have differing levels of Active Directory Access (from which we still sync our user records and most groups).
As time goes on we are defining more groups only in the Google context, and continuing our transition towards the GWfE platform.

Are there read-only or limited scope permissions that you have found beneficial to provide additional visibility/delegate access within your technology staff?

[Kim_Nilsson]

Read-only admin access

tl;dr: No.

[Kim_Nilsson]

Longer version - of read-only admin access...

1. You can push data to Google Sheets or BigQuery, and visualise that with Looker Studio, which is read-only.
2. You can give users read-only access via APIs, and then create web apps that can let them read a lot of stuff in any format you feel like coding.
3. Do the same as #2 and then set up GAMADV-XTD3 with limited access, and let them play with that.

[Kim_Nilsson]

Limited/Delegated admin access

tl;dr: DEFINITELY!

[Kim_Nilsson]

Longer version of limited/Delegated admin access

I can recommend doing this A LOT!

Keeping the number of superadmins to an absolut minimum (must be at least two!) is a very good idea.

But handing out lesser admin access, restricted to local or regional groups of users or devices is a great idea, and alleviates a lot of boring work, that those delegated admins can do instead of you.

You can create any combination of admin rights in the Admin Roles section, but the recommendation is to make sure to never mix global admin rights with restrict-able admin rights.

Global admin rights will always let the user affect all users, devices or other objects, like Group Admin.

Restrictable admin rights can be limited to OUs, like Reset Password, or Manage Devices.

Whenever a user needs to be able to do both, then create two separate custom admin roles, and assign them both, with the restrict-able set to the least access necessary.

[jasoncrcsd]

We utilize this a lot. We have delegated accounts for admins at our schools to be able to reset student passwords and etc

[Kim_Nilsson]

Yeah, I created SPOGOU for this particular purpose.