Back to Checks
googleworkspace

Super Admin account recovery is disabled

security_super_admin_recovery_disabled
Service: securitySeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

The domain-level policy disables self-service account recovery for Super Admin accounts. When disabled, Super Admins cannot use recovery options (phone, email) to regain access, reducing the risk of account takeover through compromised recovery channels.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

If Super Admin account recovery is enabled, an attacker who compromises a Super Admin's recovery phone or email could use the self-service recovery flow to take over the account, gaining full administrative control over the entire Google Workspace organization.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks security_super_admin_recovery_disabled

Recommendation

Disable Super Admin account recovery to prevent attackers from exploiting the self-service recovery flow to take over privileged accounts.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Security** > **Authentication** > **Account recovery**
3Select **Super admin account recovery**
4Uncheck **Allow super admins to recover their account**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.security.security_client import (
    security_client,
)


class security_super_admin_recovery_disabled(Check):
    """Check that Super Admin account recovery is disabled.

    This check verifies that the domain-level policy prevents Super Admin
    users from recovering their account through self-service, reducing the
    risk of account takeover through the recovery flow.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if security_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=security_client.policies,
                resource_id="securityPolicies",
                resource_name="Security Policies",
                customer_id=security_client.provider.identity.customer_id,
            )

            recovery_enabled = security_client.policies.super_admin_recovery_enabled

            if recovery_enabled is False:
                report.status = "PASS"
                report.status_extended = (
                    f"Super Admin account recovery is disabled "
                    f"in domain {security_client.provider.identity.domain}."
                )
            elif recovery_enabled is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Super Admin account recovery uses Google's secure default "
                    f"configuration (disabled) "
                    f"in domain {security_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Super Admin account recovery is enabled "
                    f"in domain {security_client.provider.identity.domain}. "
                    f"Super Admin account recovery should be disabled to prevent "
                    f"account takeover through the recovery flow."
                )

            findings.append(report)

        return findings

References