Delegate device management administrator privileges

To manage devices in your organization you need to be an administrator with mobile device management privileges. Super administrators have these privileges by default. You can also assign limited administrator privileges to some users to help with your organization's device management tasks.

What privileges can I delegate?

Users with mobile device management privileges can perform the following tasks in the organizational units that they have privileges for:

  • Review devices and device details.
  • Perform management tasks, such as approving, blocking, deleting, and wiping devices.
  • Apply settings for mobile devices and endpoints.

Additionally, only administrators who have privileges for your top-level organization can:

  • Access device reports and log events.
  • Automate mobile management tasks with rules.
  • Manage web and mobile apps.
  • Distribute iOS apps with Apple Volume Purchase Program (VPP).
  • Manage your organization's Apple push certificate.

Known limitations

The following limitations apply when using a custom device management role:

  • iOS advanced management—Administrators with a role assigned to a specific organizational unit cannot select Advanced management for iOS devices. This setting requires super administrator privileges.
  • Apple Push Certificate banner—On the Universal settings page, a message might state, "You need to set up an Apple Push Certificate for advanced iOS." Because only super administrators can manage these certificates, administrators without super admin privileges can ignore this message.

Step 1: Create a custom device management role

  1. In the Google Admin console, go to Menu and then Account and then Admin roles.

    You must be signed in as a super administrator for this task.

  2. Click Create new role.
  3. Enter a name and, optionally, a description for the role and click Continue.

  4. From the Privilege Name list, under Services and then Mobile Device Management, check the Manage Devices and Settings box.

    Tip: Use the Admin console privileges search box to find the privilege by name.

  5. Click Continue.

  6. Click Create role.

Step 2: Assign the role to a user

  1. From the custom device management role page, click Assign members.
  2. Enter a user and press Enter or Return on your keyboard.
  3. (Optional) To restrict the user's device management privileges to a specific organizational unit, next to the user, click the organizational unit.
  4. Select the organizational unit and click Done.
  5. Click Assign Role.

Create an admin role for an organizational unit