
The Cape Town Scenario: Twenty Staff, One Super Admin, and an Agency Knocking on the Door
Picture a hypothetical Cape Town e-commerce business - around twenty staff, a .co.za domain, Shopify checkout - that has just bought Workspace through a local reseller. A performance agency has been hired to run Google Ads and GA4, and the founder has forwarded the reseller's handover email to the one person who signed up. That person is now the only super admin. This playbook sequences the first fourteen days so that gap closes before something breaks.
Create a second super admin before you change a single role or policy. Role edits and 2SV enforcement can lock out the only super admin, and recovery through a reseller may take days.
What the Admin Console Actually Controls - and What It Does Not
Sign in at admin.google.com with a super admin account. The console governs the identity layer: who exists in the directory, how they authenticate, what apps they may install, what sharing posture their Drive inherits, and who can audit what happened. It does not govern ad performance. Ads bidding, GA4 events and Merchant Center feeds live in their own products; the console only decides who gets in.
Admin Console vs Google Ads Console vs GA4 Admin: Clearing Up the Three-Way Confusion
| Console | Governs | Who should hold it |
|---|---|---|
| admin.google.com | Identities, OUs, 2SV, app access, audit logs | Two super admins plus scoped admins |
| ads.google.com | Campaigns, billing, account access levels | Marketing lead and named agency users |
| GA4 Admin | Properties, data streams, role grants | Marketing lead; agency as Editor |
Day 1: Logging In, Verifying the .co.za Domain, and Creating a Second Super Admin
Domain verification adds a TXT or CNAME record in the control panel of whichever registrar holds the .co.za domain - a local registrar in most South African cases. Google supplies the exact record. Verify ownership before creating users, because users created on an unverified domain sit in a fragile state if the reseller's relationship lapses.
If a reseller holds super admin from handover, ask them to grant you super admin, sign in, then remove their elevated role - they do not need to remain a super admin to keep billing you. Note that Google quotes subscriptions in USD while local resellers may invoice in ZAR; treat any ZAR figure as an estimate that shifts with the exchange rate.
The second super admin should be a role-based Workspace account (for example admin@yourdomain.co.za), never a personal Gmail address belonging to one employee.
How Organisational Units Become Your Policy Engine (With a Marketing-Team OU Design)
Organisational units are the main lever for per-team policy. Design them before adding users, so nobody needs moving later.
| OU | Workspace access | Drive sharing posture | Marketplace installs | Device management |
|---|---|---|---|---|
| Permanent staff | Full core apps | External sharing allowed, warned | Allow-listed only | Managed |
| Agency / freelance | Gmail only, no Drive | No external sharing | Blocked | Unmanaged |
| Contractors | Gmail, Calendar | Internal only | Blocked | Unmanaged |
| Finance | Full core apps | Restricted | Allow-listed only | Managed |
Days 2-3: Creating Users and Groups Without Creating Chaos
Add users individually or in bulk with a CSV, placing each into the correct OU at creation rather than afterwards. Create groups for functional mailboxes - marketing@, finance@ - so access survives staff turnover. Groups are also the cleanest way to grant Docs and Drive permissions: add the agency to a shared group, then remove one membership when the contract ends.
Days 4-7: Email Authentication Records - SPF, DKIM and DMARC Explained for Local Admins
In the current Admin console under Apps and Gmail settings, generate the DKIM key for your .co.za domain and publish the TXT record at your registrar. Then set a single SPF TXT record that includes Google's sending hosts, and publish a DMARC TXT record at _dmarc starting at p=none while you read reports, then tighten. Without these, invoices from your domain land in spam and phishing spoofing becomes trivial.
Days 8-14: Setting Security Defaults - 2SV Enforcement, Password Policy and Login Challenges
In the current Admin console under Security, enforce 2-Step Verification at the top-level organisation first, then exempt any OU that genuinely needs longer. Set a minimum password length and enable login challenges for unfamiliar devices. Enrolment mechanics belong to a separate operational guide; here the decision is simply who is covered and from when, with a start date communicated in advance.
Controlling Apps and Marketplace Access: Which Third-Party Tools Should a Marketing Team Be Allowed to Install?
Set app access control to allow-listed: only vetted apps OAuth into company data. Marketing typically needs GA4, Ads, Looker Studio and a consent tool; that list is small and auditable. Anything requesting Drive-wide or Gmail-read scopes should go through a named approver before installation.
How to Give an Agency or Freelancer Ads and GA4 Access Without a Workspace Admin Role
Create agency@yourdomain.co.za rather than sharing a named employee's login, assign no Directory or Security role, then grant the specific Ads, GA4 and Merchant Center permissions inside those products. Link the measurement stack so reporting is defensible - see how Prebo Digital structures reporting. When you review governance, strategy consulting can help frame the ownership model.
The Settings Checklist Table: Setting, Menu Location, Recommended SME Default, and Why It Matters
| Setting | Where in the current console | Recommended default | Why it matters |
|---|---|---|---|
| 2SV enforcement | Security → Authentication | On for all OUs | POPIA safeguard; spend protection |
| App access control | Apps → Additional Google services | Allow-listed | Data quality and consent |
| Drive sharing | Apps → Drive and Docs | External sharing with warning | POPIA: limits personal-information exposure |
| Super admin count | Directory → Users → Admin roles | Exactly two | Continuity without over-privilege |
POPIA (Act 4 of 2013), enforceable from 1 July 2021, treats staff records and audit logs as personal information. Assigning an admin role is therefore a governance decision, not just an IT task.
Monthly Audit-Log Review: What to Look For in Admin, Login and Drive Audit Logs
Once a month, scan three logs: Admin (role grants, policy changes), Login (failed attempts, unusual locations) and Drive (external shares). Look for new super admins you did not create, 2SV being disabled, and OAuth grants to unfamiliar apps.
Separating Marketing Ownership from IT Ownership: A Handover Matrix
| Area | Marketing owns | IT / owner retains |
|---|---|---|
| Ads & GA4 access | Grant and revoke agency users | Billing and account ownership |
| Workspace roles | - | Super admin and OU policy |
| DNS records | - | Registrar login and TXT edits |
Where POPIA Fits In: Why Admin Role Assignment Is a Data-Governance Decision
Every scoped role is a decision about who can see personal information. Least privilege, two super admins, allow-listed apps and monthly log reviews satisfy the accountability principle without bureaucracy.




