Types of accounts in CubeBackup for Google Workspace
For small organizations, one CubeBackup administrator is usually enough. However, for large organizations, or for Google Workspace partners who manage backups for multiple clients, it may be helpful to enable multiple administrator accounts. Additionally, you may wish to allow individual users to view their own backups and restore files or messages themselves.
Types of accounts
There are 4 types of accounts in CubeBackup:
System Admin: Full control of CubeBackup.
Domain Admin: Administrative powers and permissions for specific domain(s).
Domain Operator: Backup & restore permissions for any Google Workspace users in specific domain(s).
OAuth login user: Backup & restore permissions for own data only.
Operations
| Operations | System administrator | Domain administrator | Domain operator | OAuth login user |
|---|---|---|---|---|
| View own backup data | ✔ | ✔ | ✔ | ✔ |
| Restore own data | ✔ | ✔ | ✔ | ✔ |
| View own restore/export history | ✔ | ✔ | ✔ | ✔ |
| View backup data for any users in managed domain(s) | ✔ | ✔ | ✔ | ✖ |
| Restore data for any users in managed domain(s) | ✔ | ✔ | ✔ | ✖ |
| Restore data for one user to another user | ✔ | ✔ | ✔ | ✖ |
| View backup/restore/export history of managed domain(s) | ✔ | ✔ | ✔ | ✖ |
| View statistical data for managed domain(s) | ✔ | ✔ | ✔ | ✖ |
| Google Workspace domain specific settings (e.g. data retention policy, enable/disable backups for users, enable/disable backup of shared drives) | ✔ | ✔ | ✖ | ✖ |
| Manually start the backup | ✔ | ✔ | ✖ | ✖ |
| Edit storage information | ✔ | ✖ | ✖ | ✖ |
| Migrate the backup data | ✔ | ✖ | ✖ | ✖ |
| System-wide settings (e.g. backup interval, network throttling, email reports) | ✔ | ✖ | ✖ | ✖ |
| Add or delete other administrative accounts | ✔ | ✖ | ✖ | ✖ |
| View audit log | ✔ | ✖ | ✖ | ✖ |
| Add new Google Workspace domains to CubeBackup | ✔ | ✖ | ✖ | ✖ |
Account Recommendations
- Small organizations who have only one Google Workspace domain: 1 or 2 system administrators are enough. You can also enable Google OAuth login for all end-users in your domain according to the data policy in your organization.
- Large organizations: 1 or 2 system administrator accounts, plus a few domain operators. We recommend that Google OAuth login be turned on for all end-users in your organization.
- Google Workspace partners: 1 or 2 system administrator accounts. You can assign each Google Workspace domain a domain administrator so that your customers can manage their own backup data. You can also discuss with your clients whether to enable Google OAuth login.
NOTE
- Only system administrators can add more administrators/operators to CubeBackup.
- Administrators and operators are not the only accounts which can recover and export user data. End users can also be authorized to access their own backup data and even restore files and messages by themselves. If you'd like to enable self-service data recovery for end users, please refer to How end users can recover their own Google Workspace data through Google OAuth Login.