super admin
Super admin is the top level of access on an account, the role that can add or remove anyone else, change billing, and lock everyone else out, and it should always belong to the business.
Almost every account, whether it is Cloudflare, Google Workspace, or an ad platform, has a hierarchy of access. Most people who touch the account day to day have some working level of access: enough to make changes, check reports, or manage settings. Super admin sits above all of that. It is the role that can add or remove any other user, change what card is on file, and, if it ever needed to, cut off everyone else’s access entirely.
Whoever holds super admin effectively owns the account, regardless of who set it up or who does the technical work inside it. That is precisely why it matters who holds it.
Why it matters to you
A surprising number of small business accounts end up with a vendor or a past contractor sitting in the super admin seat, often because that person set the account up in the first place and it was simpler at the time. It works fine until the relationship changes. Then the business discovers it does not actually control its own domains, its own analytics, or its own ad account, and getting that access back can be a slow, sometimes contentious process. Holding super admin yourself means that situation cannot happen to you, no matter what happens with any contractor down the line.
How I set it up
Every account I create for a client, whether that is Cloudflare, Google Workspace, or an ad account, is created using the business’s own email address from the start, with the business as super admin. I am invited in at whatever level lets me do the actual work: managing DNS, deploying the site, adjusting ad campaigns. I never hold the top-level role on an account that belongs to the business. This is the same principle that runs through everything I do around access, not ownership: I need enough access to do the job well, and no more than that.
Turning on two-factor authentication for the super admin login is the other half of this. Super admin only actually protects a business if the login itself cannot be casually taken over, so the two go together in every setup I do.
What it looks like in practice
If you log into Cloudflare, or Google Workspace, or the ad platform, and check the account’s user list, you will see yourself, or the business’s own email, at the top of the permissions list, with me listed as an added user underneath at whatever access the work needs. If I ever became unreachable, the business could remove my access, change the password, and carry on, without needing anyone’s permission to do it.
Questions I get about this
- What's the difference between super admin and just having a login?
- A regular login can do the day-to-day work: managing DNS records, checking analytics, adjusting settings. Super admin sits above that. It can add or remove anyone else's access, change billing, and take the account back entirely, at any time.
- If my contractor needs to do the technical work, why shouldn't they be super admin?
- Because super admin is also the role that can lock you out. Keeping it in the business's name means the business always has the final say, no matter what happens to the working relationship with any one contractor.
- Is this hard to set up?
- No. It usually means creating the account with the business's own email from the start, rather than a contractor's, then inviting the contractor in at whatever access level the work actually needs.
Want this set up properly for your business?
This is the kind of thing I build every week. Grab a time and we will talk through what fits.