The Google admin console is a MASSIVE resource with thousands of settings for Chromebook management, Google applications, and third party tools.

The admin console is overwhelming for me, and I spend a LOT of time tinkering and exploring all of these tools.

While you certainly don’t want a lot of people with full access to the admin console, you can delegate simple management tasks by assigning limited “admin roles” to key users in your district.

These defined roles provide individuals with access to a small portion of the admin console, giving them the ability to reset passwords, create new users, or approve Chrome extensions.

There are some pre-defined roles that are pretty self-explanatory:

• Super Admin: full console access
• User management: add, delete, rename, and reset users
• Help desk admin: reset passwords only
• Services admin: configure service settings
• Groups Admin: view users, create and modify groups

These roles are pre-configured and available right now. Just assign them to a user in your organization.

What’s missing from this list? Chromebooks!

Google doesn’t provide a pre-defined role for Chromebook management.

The good news is that you can create a custom role to delegate specific Chromebook tasks to trusted users in your organization.

These custom roles will provide LIMITED access to specific area of the admin console. You can even limit their access to a specific organizational unit (OU) within your district!

Here are three custom Google admin roles that I would recommend.

Related video: creating custom roles in the Google Admin Console

Chromebook hardware administrator

This custom role will provide access to the Chrome device settings which control policies related to device enrollment, software updates, sign-in settings, and device reporting.

This user will also have the ability to enroll, de-provision, disable, and move devices between OUs.

While this group of settings is important, it doesn’t typically require frequent adjustment.

Most districts do their initial setup and leave it alone, baring new updates or additions.

Note: This administrative role CAN be locked to a specific organizational unit, preventing a user from making changes to devices that aren’t in their building. The Chrome Device settings apply to DEVICES so make sure you lock OU access to a device OU.

Required policies:

• Manage ChromeOS Devices
• Manage ChromeOS Device Settings

Chrome browser administrator

This administrative role provides access to the Chrome user settings which configure policies related to the chrome browser.

This group of settings is very large and includes the ability to adjust the screen lock settings, incognito access, bookmark settings, screenshot and webcam restrictions, and much more.

While these settings are primarily used to manage Chromebooks, certain settings also apply to the Chrome browser on Windows and Mac devices.

This group of settings will require frequent adjustments based on your district policies and student behavior.

For example, some schools have created a Chromebook “penalty box” OU for students who use technology inappropriately. Many of the settings for the penalty box OU are located in the Chrome User & Browser settings section of the admin console.

Note: this policy CAN be locked to a specific organizational unit, preventing changes that would apply to your entire district. The Chrome User & Browser policies are USER settings, so make sure you restrict OU access to a USER OU, not a device OU.

Required Policies:

• Manage User Settings
• Manage Application Settings (included with user settings)

Chrome application manager

This is a very limited role that gives a user the ability to add or remove Chrome extensions and applications from your districts list of approved resources.

This administrative role is especially useful for districts that block all applications accept for those that are specifically added to the white-list.

It can be cumbersome for an IT director to field constant requests to add new applications to the allow list. Delegating this Chromebook management task to a trusted staff member will make your teachers happy and eliminate a simple administrative tasks.

Related Post: Top Chrome Apps & Extensions for the Classroom

Note: this policy CAN be locked to a specific organizational unit, preventing changes that would apply to your entire district. Application approvals are a USER settings, so make sure you restrict OU access to a USER OU, not a device OU.

Required Policies: manage application settings

Stack them all together!

You can assign multiple administrative roles to a user.

If you have someone who is capable of managing device, browser, and application settings, assign all three administrative roles!

I recommend creating three seperate roles rather than one “super Chromebook admin” role. This will give you more flexibility in assigning smaller tasks as appropriate.

Chromebook management support

If you are in charge of using the Google Admin console to manage your devices and users, you should check out my Google Admin YouTube channel.

You might also benefit from attending the Google Admin Bootcamp, my LIVE virtual course that will help you navigate the console and make sure that your district technology services are running in tip-top shape!

During the admin bootcamp we will discuss Chromebook management, enrollment, and security settings in great depth.

You can check out the dates for my upcoming sessions by visiting GoogleAdminBootcamp.com, or add your name to the wait-list below.