News
Google Workspace lets admins grant time-limited admin roles that revoke themselves
Google Workspace admins can now give an admin role to a user, group or service account for a set period; when it expires, the access is removed automatically. Available to all customers.
On September 23, 2026, Google announced on the Google Workspace Updates blog that admins can now assign time-limited administrator roles in the Google Admin console. A role can go to a user, a group or a service account; when the expiry time is reached, the access that role granted is revoked automatically.
Details
- When assigning a role, a super admin picks a preset duration (for example 30 days) or sets a custom expiry date and time.
- Temporary roles cannot be given to the organisation's primary admin, because that account always needs permanent super admin rights.
- There is no end-user setting for this feature.
- It is available to all Google Workspace customers and is already live on both Rapid Release and Scheduled Release.
Why small businesses should care
In small companies, Google Workspace admin rights are often handed out to outsiders or for short jobs: an outsourced IT provider during an email migration, a colleague covering while the usual admin is on leave, or auditors who need to review settings. Once the job is done, the rights often stay because nobody remembers to remove them. Google says time-limited roles reduce standing privileged access — a security risk — and remove the need to track and revoke access by hand.
What to do
- Next time you grant admin rights for a short-term task, set an expiry date instead of granting them permanently.
- Review which accounts currently hold admin roles in the Admin console; remove those no longer needed and re-assign time-limited roles to people who only need access for a while.
- Step-by-step instructions are in Google Workspace Admin Help under "Assign admin roles for a specific duration".