Back to Checks
googleworkspace

Domain has 2-4 super administrators

directory_super_admin_count
Service: directorySeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Google Workspace domain has between 2 and 4 super administrators.

Having too few super admins creates a single point of failure and administrative access issues if the only admin is unavailable. Having too many super admins increases the attack surface and the risk of unauthorized access to critical administrative functions.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Having fewer than 2 super administrators creates a single point of failure and may prevent administrative access in emergencies.

Having more than 4 super administrators increases the security risk by expanding the attack surface for compromised accounts with full administrative privileges.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks directory_super_admin_count

Recommendation

Review the list of super administrators in your Google Workspace Admin console. Add more super admins if you have fewer than 2, or remove unnecessary super admin privileges if you have more than 4. Consider using delegated admin roles for users who need limited administrative capabilities.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Directory** > **Users**
3Click on a user to view their details
4Click **Admin roles and privileges**
5To add super admin: Check **Super Admin** role and click **Save**
6To remove super admin: Uncheck **Super Admin** role and click **Save**
7Ensure your domain has **2-4 super administrators** for operational resilience and security. For users requiring limited administrative access, assign specific delegated admin roles instead of super admin privileges.

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.directory.directory_client import (
    directory_client,
)


class directory_super_admin_count(Check):
    """Check that the number of super admins is between 2 and 4

    This check verifies that the Google Workspace domain has between 2 and 4 super administrators.
    Having too few admins creates a single point of failure, while too many increases security risk.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        super_admins = [
            user for user in directory_client.users.values() if user.is_admin
        ]
        admin_count = len(super_admins)

        report = CheckReportGoogleWorkspace(
            metadata=self.metadata(),
            resource=directory_client.provider.domain_resource,
            resource_id="directoryUsers",
            resource_name="Directory Users",
            customer_id=directory_client.provider.identity.customer_id,
        )

        if 2 <= admin_count <= 4:
            report.status = "PASS"
            report.status_extended = (
                f"Domain {directory_client.provider.identity.domain} has {admin_count} super administrator(s), "
                f"which is within the recommended range of 2-4."
            )
        else:
            report.status = "FAIL"
            if admin_count < 2:
                report.status_extended = (
                    f"Domain {directory_client.provider.identity.domain} has only {admin_count} super administrator(s). "
                    f"It is recommended to have between 2 and 4 super admins to avoid single point of failure."
                )
            else:
                report.status_extended = (
                    f"Domain {directory_client.provider.identity.domain} has {admin_count} super administrator(s). "
                    f"It is recommended to have between 2 and 4 super admins to minimize security risk."
                )

        findings.append(report)
        return findings

References