services / Workspace / Super Admin

Google super admins have access to all features in Google Admin, can alter any organizational settings, and have full access to all users' calendars. Some actions can only be taken by super admins, including: creating and assigning administrator roles, managing other super admins, inviting unmanaged user accounts, restoring deleted user accounts, installing Google Marketplace apps, granting domain-wide delegation, and modifying SAML apps.

SUPER_​ADMIN

Super admins have the highest level of privilege in a Workspace account. Holding this privilege allows creation and deletion of accounts, as well as account takeover via password reset. It allows modification of administrator roles and role assignments. It also can allow disabling (or enabling) of two- factor security settings.

Risks

1. Account destruction (CRITICAL)
2. Account takeover (CRITICAL)
3. Cryptographic destruction (CRITICAL)
4. Policy destruction (CRITICAL)
5. Privilege escalation (CRITICAL)
6. Infrastructure destruction (HIGH)
7. Account persistence (BOOST)
8. Defense destruction (EVASION)
9. Metadata destruction (MEDIUM)
10. Account discovery (LOW)
11. Policy discovery (LOW)

Scope: UNKNOWN

Links