{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/google-workspace-role-scope-two-approval-requests/", "item": { "id": "https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/", "slug": "google-workspace-role-scope-two-approval-requests", "url": "https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests.md", "json": "https://update.dsesecurity.com/api/v1/posts/google-workspace-role-scope-two-approval-requests/" }, "title": "Expect two approvals when changing Google Workspace admin-role scope under multi-party review", "summary": "A move between organizational-unit scopes can remain pending until both generated requests are approved.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "microsoft-365-identity", "name": "Microsoft 365 & Identity", "url": "https://update.dsesecurity.com/topic/microsoft-365-identity/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:33:58+00:00", "modified_at": "2026-10-15T13:36:18+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 268, "potentially_affected": "This concerns Google Workspace role-management multi-party approval where the feature is available and configured. It does not imply that every administrative operation or every API request is automatically covered.", "dse_recommendation": "DSE recommends documenting the role, old scope, new scope, and intended approver before submitting a scope change.", "primary_source": { "name": "Google — Assign admin roles", "url": "https://knowledge.workspace.google.com/admin/users/assign-specific-admin-roles?hl=en", "published_on": null, "authority": "knowledge.workspace.google.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A move between organizational-unit scopes can remain pending until both generated requests are approved.

\n

Source facts

\n

Google Workspace can require multi-party review for administrator-role assignments. A requesting administrator initiates the change and a super administrator reviews it. The documented role-management controls can cover Admin console changes and API changes through separate settings. Changing an existing role assignment from one organizational-unit scope to another creates two approval requests, and both must be approved for the scope change to take effect. Not every role supports organizational-unit scoping; the assignment interface indicates whether that scope can be edited.

\n

Source: Google — Assign admin roles.

\n

Applicability

\n

This concerns Google Workspace role-management multi-party approval where the feature is available and configured. It does not imply that every administrative operation or every API request is automatically covered.

\n

DSE recommendation

\n

DSE recommends documenting the role, old scope, new scope, and intended approver before submitting a scope change. Tell reviewers to expect the related pair of requests and assess them as one access change. Review the console and API approval settings separately so automation follows the intended governance. Maintain a pending-request checklist for the helpdesk, and avoid repeated resubmission while an existing request is awaiting its second decision. Recheck the final assignment rather than assuming one approval completed the move.

\n

Verification

\n

With a low-impact test role and two test organizational units, observe the requests generated by an approved scope change. Confirm the effective scope before and after both decisions. Check the documented console and API settings and verify that an unsupported role is not mistakenly described as organizational-unit restricted.

\n

Official reference

\n

Google — Assign admin roles. Reviewed October 15, 2026.

", "content_text": "A move between organizational-unit scopes can remain pending until both generated requests are approved.\nSource facts\nGoogle Workspace can require multi-party review for administrator-role assignments. A requesting administrator initiates the change and a super administrator reviews it. The documented role-management controls can cover Admin console changes and API changes through separate settings. Changing an existing role assignment from one organizational-unit scope to another creates two approval requests, and both must be approved for the scope change to take effect. Not every role supports organizational-unit scoping; the assignment interface indicates whether that scope can be edited.\nSource: Google — Assign admin roles.\nApplicability\nThis concerns Google Workspace role-management multi-party approval where the feature is available and configured. It does not imply that every administrative operation or every API request is automatically covered.\nDSE recommendation\nDSE recommends documenting the role, old scope, new scope, and intended approver before submitting a scope change. Tell reviewers to expect the related pair of requests and assess them as one access change. Review the console and API approval settings separately so automation follows the intended governance. Maintain a pending-request checklist for the helpdesk, and avoid repeated resubmission while an existing request is awaiting its second decision. Recheck the final assignment rather than assuming one approval completed the move.\nVerification\nWith a low-impact test role and two test organizational units, observe the requests generated by an approved scope change. Confirm the effective scope before and after both decisions. Check the documented console and API settings and verify that an unsupported role is not mistakenly described as organizational-unit restricted.\nOfficial reference\nGoogle — Assign admin roles. Reviewed October 15, 2026.", "content_markdown": "A move between organizational-unit scopes can remain pending until both generated requests are approved.\n\n## Source facts\n\nGoogle Workspace can require multi-party review for administrator-role assignments. A requesting administrator initiates the change and a super administrator reviews it. The documented role-management controls can cover Admin console changes and API changes through separate settings. Changing an existing role assignment from one organizational-unit scope to another creates two approval requests, and both must be approved for the scope change to take effect. Not every role supports organizational-unit scoping; the assignment interface indicates whether that scope can be edited.\n\nSource: [Google — Assign admin roles](https://knowledge.workspace.google.com/admin/users/assign-specific-admin-roles?hl=en).\n\n## Applicability\n\nThis concerns Google Workspace role-management multi-party approval where the feature is available and configured. It does not imply that every administrative operation or every API request is automatically covered.\n\n## DSE recommendation\n\nDSE recommends documenting the role, old scope, new scope, and intended approver before submitting a scope change. Tell reviewers to expect the related pair of requests and assess them as one access change. Review the console and API approval settings separately so automation follows the intended governance. Maintain a pending-request checklist for the helpdesk, and avoid repeated resubmission while an existing request is awaiting its second decision. Recheck the final assignment rather than assuming one approval completed the move.\n\n## Verification\n\nWith a low-impact test role and two test organizational units, observe the requests generated by an approved scope change. Confirm the effective scope before and after both decisions. Check the documented console and API settings and verify that an unsupported role is not mistakenly described as organizational-unit restricted.\n\n## Official reference\n\n[Google — Assign admin roles](https://knowledge.workspace.google.com/admin/users/assign-specific-admin-roles?hl=en). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/", "url": "https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Expect two approvals when changing Google Workspace admin-role scope under multi-party review", "item": "https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/#article", "identifier": "https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/", "url": "https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/", "headline": "Expect two approvals when changing Google Workspace admin-role scope under multi-party review", "description": "A move between organizational-unit scopes can remain pending until both generated requests are approved.", "abstract": "A move between organizational-unit scopes can remain pending until both generated requests are approved.", "articleBody": "A move between organizational-unit scopes can remain pending until both generated requests are approved.\nSource facts\nGoogle Workspace can require multi-party review for administrator-role assignments. A requesting administrator initiates the change and a super administrator reviews it. The documented role-management controls can cover Admin console changes and API changes through separate settings. Changing an existing role assignment from one organizational-unit scope to another creates two approval requests, and both must be approved for the scope change to take effect. Not every role supports organizational-unit scoping; the assignment interface indicates whether that scope can be edited.\nSource: Google — Assign admin roles.\nApplicability\nThis concerns Google Workspace role-management multi-party approval where the feature is available and configured. It does not imply that every administrative operation or every API request is automatically covered.\nDSE recommendation\nDSE recommends documenting the role, old scope, new scope, and intended approver before submitting a scope change. Tell reviewers to expect the related pair of requests and assess them as one access change. Review the console and API approval settings separately so automation follows the intended governance. Maintain a pending-request checklist for the helpdesk, and avoid repeated resubmission while an existing request is awaiting its second decision. Recheck the final assignment rather than assuming one approval completed the move.\nVerification\nWith a low-impact test role and two test organizational units, observe the requests generated by an approved scope change. Confirm the effective scope before and after both decisions. Check the documented console and API settings and verify that an unsupported role is not mistakenly described as organizational-unit restricted.\nOfficial reference\nGoogle — Assign admin roles. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:33:58+00:00", "dateModified": "2026-10-15T13:36:18+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Expect two approvals when changing Google Workspace admin-role scope under multi-party review" }, "articleSection": [ "Cybersecurity", "Microsoft 365 & Identity" ], "keywords": [ "Cybersecurity", "Microsoft 365 & Identity", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Microsoft 365 & Identity", "url": "https://update.dsesecurity.com/topic/microsoft-365-identity/" } ], "wordCount": 268, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Google — Assign admin roles", "url": "https://knowledge.workspace.google.com/admin/users/assign-specific-admin-roles?hl=en" } } ] } }