# Expect two approvals when changing Google Workspace admin-role scope under multi-party review

> A move between organizational-unit scopes can remain pending until both generated requests are approved.

- Canonical URL: https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:58+00:00
- Modified: 2026-10-15T13:36:18+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Microsoft 365 & Identity
- Reading time: 2 minutes

## What you need to know

A move between organizational-unit scopes can remain pending until both generated requests are approved.

## Potentially affected

This concerns Google Workspace role-management multi-party approval where the feature is available and configured. It does not imply that every administrative operation or every API request is automatically covered.

## DSE recommendation

DSE recommends documenting the role, old scope, new scope, and intended approver before submitting a scope change.

## Article

A move between organizational-unit scopes can remain pending until both generated requests are approved.

## Source facts

Google Workspace can require multi-party review for administrator-role assignments. A requesting administrator initiates the change and a super administrator reviews it. The documented role-management controls can cover Admin console changes and API changes through separate settings. Changing an existing role assignment from one organizational-unit scope to another creates two approval requests, and both must be approved for the scope change to take effect. Not every role supports organizational-unit scoping; the assignment interface indicates whether that scope can be edited.

Source: [Google — Assign admin roles](https://knowledge.workspace.google.com/admin/users/assign-specific-admin-roles?hl=en).

## Applicability

This concerns Google Workspace role-management multi-party approval where the feature is available and configured. It does not imply that every administrative operation or every API request is automatically covered.

## DSE recommendation

DSE recommends documenting the role, old scope, new scope, and intended approver before submitting a scope change. Tell reviewers to expect the related pair of requests and assess them as one access change. Review the console and API approval settings separately so automation follows the intended governance. Maintain a pending-request checklist for the helpdesk, and avoid repeated resubmission while an existing request is awaiting its second decision. Recheck the final assignment rather than assuming one approval completed the move.

## Verification

With a low-impact test role and two test organizational units, observe the requests generated by an approved scope change. Confirm the effective scope before and after both decisions. Check the documented console and API settings and verify that an unsupported role is not mistakenly described as organizational-unit restricted.

## Official reference

[Google — Assign admin roles](https://knowledge.workspace.google.com/admin/users/assign-specific-admin-roles?hl=en). Reviewed October 15, 2026.

## Primary reference

- Name: Google — Assign admin roles
- Authority: knowledge.workspace.google.com
- URL: https://knowledge.workspace.google.com/admin/users/assign-specific-admin-roles?hl=en
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Expect two approvals when changing Google Workspace admin-role scope under multi-party review,” DSE Security, https://update.dsesecurity.com/updates/google-workspace-role-scope-two-approval-requests/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.