3.4 KiB
- Grant a User an Admin Role
- Delete a User's Admin Role
- Print All Admin Role Assignments
- Print All Admin Roles
Grant a User an Admin Role
Syntax
gam create admin <user> <role> customer|org_unit <OU> [condition securitygroup|nonsecuritygroup]
Grants the given user account rights as the given admin role. The command must specify whether the rights are to be granted to the entire customer G Suite domain or to a certain org_unit and it's children org unit's. Note that some roles cannot be granted to org units, they must specify customer. The optional argument condition limits the conditions for delegate admin access. This currently only works with the _GROUPS_EDITOR_ROLE and _GROUPS_READER_ROLE roles. Condition can be to limit the delegated admin to managing security groups (securitygroup) or to non-security groups (nonsecuritygroup).
Examples
This example makes admin@acme.com a super admin
gam create admin admin@acme.com _SEED_ADMIN_ROLE customer
This example makes ny-helpdesk@acme.com a helpdesk admin for the /NY Org Unit.
gam create admin ny-helpdesk@acme.com _HELP_DESK_ADMIN_ROLE org_unit "NY"
This example allows sfo-helpdesk@acme.com to manage only groups that are NOT marked as security groups:
gam create admin sfo-helpdesk@acme.com _GROUPS_EDITOR_ROLE customer condition nonsecuritygroup
Delete a User's Admin Role
Syntax
gam delete admin <role assignment id>
Removes an admin role assignment. Use Print All Admins to see existing assignments, you're looking for the roleAssignmentId column. You can also use CSV commands to revoke all rights for a given user.
Examples
This example revokes the given user's admin role.
gam delete admin 8771356963373081
This example revokes ALL admin role assignments for the oldadmin@acme.com user account.
gam print admins user oldadmin@acme.com | gam csv - gam delete admin ~roleAssignmentId
Print All Admins
Syntax
gam print admins [user <user>] [role <role>] [condition] [todrive]
Prints all admin role assignments in the G Suite instance. Note that one user account can be assigned multiple roles and can be assigned one role on multiple orgs so a single user may be returned in multiple rows.
The optional user argument limits returned role assignments to those granted to the given user.
The optional role argument limits returned role assignments to those of the given role.
The optional condition argument displays any conditions associated with a role assignment.
The optional todrive argument tells GAM to create a Google Docs Spreadsheet instead of outputting the results to CSV.
Examples
This example prints out all admin role assignments
gam print admins
This example prints out all admin role assignments for admin@acme.com
gam print admins user admin@acme.com
This example prints out all super admin role assignments
gam print admins role _SEED_ADMIN_ROLE
Print All Admin Roles
Syntax
gam print roles [todrive]
Prints all admin roles created within the G Suite Instance. The optional argument todrive causes GAM to create a Google Docs Spreadsheet of results instead of outputting CSV.
Examples
This example creates a spreadsheet of all admin roles for a domain.
gam print roles todrive