The Google Workspace Admin Console, Explained for Business Owners

A new accountant starts on Monday and needs an email address. The person who set up your email two years ago is no longer with you. Nobody knows the password to whatever it is you are supposed to log into.

That thing is the Google Workspace admin console, and it is not complicated. It is a web page at admin.google.com where everything about your company's email and files is decided: who has an account, who can read what, what happens when a laptop is stolen, and what happens when a staff member leaves.

Most owners never open it, which is fine right up until the day it matters. This guide is the short version: the eight jobs worth knowing, in the order you are likely to need them, with the exact menu names as Google labels them today. Everything here is from Google's own admin documentation, read on 12 November 2026.

What the Console Is, and the One Rule About Logging In

The admin console is where admins manage Google services for everyone in an organisation. You open it at admin.google.com and sign in with an administrator account.

Here is the rule that trips people up: an admin account does not end in @gmail.com. It is an address on your own domain, such as you@yourbusiness.co.ke. If you sign in with a personal Gmail address, the console simply will not open, because that account administers nothing. (Google: Sign in to your Admin console)

If nobody in the building knows which address is the admin, that is the first thing to establish, not the last. Account recovery for a super administrator is far harder than remembering a password.

The Map: Eight Areas and What Lives in Each

The left-hand Menu holds everything. You will spend almost all of your time in the first two rows.

1. Add Someone Before Their First Morning

Go to Menu > Directory > Users, then click Add new user. You give a first name, a last name and the part of the address before the @, and Google either generates a password or lets you set one that the person must change at first sign-in.

Two things to know before you click:

• A new user is a new licence, and it is billed. Google's licensing is per user, so an extra account means an extra charge from the day you create it. On Business Starter that is USD 7.00 per user per month on the annual plan; the shilling price is on our Google Workspace page.
• Do not create an account for a role. A second paid account for info@ is money spent on something an alias does for free. More on that below.

Give the new person their address and temporary password separately from each other, by two different channels, and tell them to turn on 2-Step Verification the same day.

2. Reset a Password, or Get an Account Back

In Directory > Users, click the person, then Reset password. You can generate one or type one, and you can require a change at next sign-in. This is the job you will do most often, usually on a Monday.

If it is your own super admin password that is lost, that is a different and much slower road: Google's recovery process, and in some cases a verification of your domain ownership through your DNS records. This is the strongest argument for the rule further down about having more than one super admin.

3. Get info@ and sales@ Without Paying for Them

This is the single most expensive misunderstanding we meet in Kenyan Workspace accounts: businesses paying for four or five licences, most of which are role addresses nobody signs into.

Google lets you add up to 30 email aliases to each user, at no extra cost. Mail sent to the alias arrives in that user's normal inbox, and they can send from it. A one-person business can run info@, sales@ and billing@ off a single paid account. (Google: Add or delete an email alias)

The limits matter, so here they are plainly:

• An alias cannot be shared. Only one user can hold it, and you cannot sign in with it. If two people must both read info@, use a group (Directory > Groups) or Gmail delegation instead.
• An alias cannot reuse an existing account name. If sales@ already exists as a user, it cannot also be an alias.
• An alias is not private. It can be visible to recipients, so do not treat one as a secret address.

4. When Someone Leaves: Suspend, Archive or Delete

The instinct is to delete the account and stop paying for it. Do that in the wrong order and you lose the mail.

Google's rule is specific: before you can transfer a deleted user's data, you have to restore that user within 20 days of deletion. Miss the window and the contents are not recoverable. Google's own advice, if you want to keep the data, is to suspend or archive the user instead. (Google: Delete or remove a user)

So the safe order when a staff member leaves is:

5. Turn On 2-Step Verification

A business email account holds your quotations, your bank correspondence and your customer list, and it is protected by one password that somebody types on a phone in a matatu. 2-Step Verification is the single change with the best return in the whole console.

The setting is at Menu > Security > Authentication > 2-step verification, and you must be signed in as a super administrator. You can apply it to the whole organisation or to one department or group, and you can allow it first and enforce it from a date you choose, which is the kinder way to roll it out. (Google: Deploy 2-Step Verification)

Two points from the same documentation worth repeating to your team:

• Google is now enforcing 2SV for administrator accounts. If you administer a Workspace account, this is no longer a choice you are making.
• Security keys are the strongest method, because they resist phishing in a way that codes sent by text message do not.

To see who has actually enrolled, rather than who said they would, go to Menu > Reporting > User Reports > Security.

6. Decide Who Holds the Keys

Google's security guidance for admin accounts is short and we have never seen a Kenyan SME follow all of it. The four rules that matter most:

• Have more than one super admin, each one a separate person. If a single account is lost or compromised, somebody else can still do critical work. (Google: Security best practices for administrator accounts)
• Never share an admin account. If three people sign in as admin@, the audit log cannot tell you which of them made a change.
• Do not use a super admin account for daily email. Google recommends two accounts per admin: one for admin tasks, one for normal work.
• Delegate instead of promoting. Somebody who only resets passwords does not need full control; the console has narrower admin roles for exactly that.

Three Things the Console Cannot Do

Plenty of email problems get blamed on Workspace when the fix is somewhere else entirely. These three live in your domain's DNS, not in the console:

• MX records. Where your mail is delivered is decided at your domain host. Google Workspace now uses a single MX value, smtp.google.com at priority 1, and other MX records should be removed. Changes can take up to 72 hours to be recognised. (Google: Set up MX records)
• DMARC. Google states plainly that you do not need to do anything in the Admin console to set up DMARC. It is a TXT record you add at your domain host. (Google: Set up DMARC)
• DKIM on day one. DKIM is generated in the console, under Apps > Google Workspace > Gmail > Authenticate email, but Google says you must wait 24 to 72 hours after turning on Gmail before the key can be created. Try sooner and you get an error. It is the one step in a new setup that cannot be finished the same afternoon. (Google: Set up DKIM)

If those three records are wrong or missing, your mail still sends; it just lands in other people's spam folders. We wrote a separate guide on how DNS records work, and the three records that decide whether your email arrives.

Four Mistakes We See Most Often

1. One super admin, and they have left the company. The most common Workspace emergency we are called into, and the hardest to fix quickly.
2. Paying for role addresses. Four licences where one licence and three free aliases would do the same job.
3. Deleting a leaver on their last day. Three weeks later somebody needs a contract from that inbox, and the 20-day window has closed.
4. 2-Step Verification "on" but never enforced. Allowed for everyone, enrolled by two people, which is not the same as protected.

Frequently Asked Questions

What is the Google Workspace admin console?

It is the control panel for your organisation's Google services, at admin.google.com. From there an administrator creates and removes staff accounts, resets passwords, adds email addresses, turns 2-Step Verification on, and sees who signed in. Only an admin account can open it, and an admin account never ends in @gmail.com.

Can I get a deleted Google Workspace account back?

Google says you have 20 days from deletion to restore the user, and that you must restore the account before you can transfer its data. After that window the mail and files are gone. If someone is leaving, suspend or archive the account instead of deleting it.

Do I have to pay for an info@ or sales@ address?

Not if one person reads it. Google lets you add up to 30 email aliases to a user at no extra cost, so info@ can land in your own inbox. An alias cannot be shared between people, so when two staff must both read an address, use a group or Gmail delegation instead of a second paid licence.

Why can I not find my DMARC setting in the admin console?

Because it is not there. Google states that nothing in the Admin console sets up DMARC: the record is a DNS TXT record you add where your domain is managed. The same is true of your MX records. Only DKIM is generated inside the console.

How many super administrators should a small business have?

More than one. Google's own guidance is that an organisation should have several super admin accounts, each held by a different person, so that one lost or compromised account does not lock everybody out. Google also says not to share a single admin account and not to use a super admin account for daily work.