Admin roles and privileges
To onboard customers to Chrome Enterprise Premium (CEP) and enable Google Chrome integration, you must assign the appropriate roles and privileges in the Google Admin console.
Types of admin roles
Two types of roles are available in the Google Admin console:
- System Role: These are default roles provided by Google. They typically do not include all the necessary privileges required for Google Chrome integration.
- Custom Role: These are roles you create, allowing you to include all necessary privileges specifically for Chrome integration. We recommended to create a custom admin role with all the required privileges for Google Chrome integration.
Note: Super admin roles cannot be assigned to service accounts.
Create and assign roles and privileges
Perform the following steps to create a custom admin role and assign privileges:
- In the Google Admin console, go to Accounts > Admin roles.
- Click Create new role and enter a name and description for the role.
-
Add all the privileges required for Google Chrome integration to this custom role. For the list of required privileges, see Required privileges for Google Chrome integration.
For more information related to roles and privileges, see the Google documentation.
- Save the custom role.
- After creating the custom role, open the role and click Assign members.
- Select the users who need these permissions.
Required privileges for Google Chrome integration
The following privileges must be enabled in the admin role that is assigned to the service account.
-
Admin Console privileges:
- Manage Application Settings (Services > Chrome Management > Settings > Manage User Settings > Manage Application Settings)
-
Admin API Privileges:
-
Manage Customer > Read customer
- Read customer branding settings
- Read customer onboard settings
- Read customer profile settings
- Read customer support settings
- Read customer timezone settings
-
Manage Customer > Update customer
- Update customer branding settings
- Update customer onboard settings
- Update customer profile settings
- Update customer support settings
- Update customer timezone settings
-
- Billing Management > Billing Read
- Domain Management
- Groups > Read
- Organization Units > Read
- Domain Allowlist Management > Domain Allowlist Read