Give the right people the right access
Everyone starts as a Member. Give admin access one person at a time, use limited or custom roles, and turn on admin safeguards.
Steps
Open Admin console › People › Roles & admins. You see who is an owner, admin or auditor, and who has a limited role.
Choose Give access, pick the person and the smallest role that does the job: Admin (runs the organization), a limited role such as Helpdesk or Security admin, or a custom role. Limited roles can apply to one department or team, and any access can end automatically.
To build a custom role, choose New role, name it (for example IT Support) and tick only the areas it needs: People, Security, Organization, Billing, Audit or Vaults.
Vaults (Vault manager) lets someone create company vaults, delete the vaults they manage and approve exit requests. Give it for one team to make a team lead: they decide exits for their own people.
Confirm it's you when asked. Every grant is recorded in the audit log and raises an alert.
Remove access you no longer need from the same screen, or export the list for your auditors.
Good to know
- Admin safeguards (owners only): admins must use two-step verification or a passkey, admin access needs a recent sign-in, only owners give the Admin role, optional second-admin approval, and automatic expiry.
- There is no way to make everyone an admin at once, on purpose: each admin is a target for attackers. Use custom roles for teams that need a little more access.