Enhanced security monitoring with expanded Admin password reset

Enhanced security monitoring with expanded Admin password reset alerts

In Alert Center, we are expanding the existing “Super Admin password reset” alert into a broader Admin password reset alert. Previously, this rule only triggered alerts when a super admin’s password was changed. With this update, the alert will now cover password resets for all administrator roles within your organization.

This update provides admins with better visibility and control over the security of their organization’s privileged accounts. Monitoring password changes for all admin roles provide a higher level of oversight to respond more quickly to potential account compromises or unauthorized changes.

This change aligns with security best practices by treating all administrative access with increased vigilance.

Getting started

Admins: This feature will be ON by default and automatically replaces the previous “Super Admin password reset” rule. No action is required to enable the new alert. If you had modified the recipient list for the previous rule, those settings will automatically carry over to the new rule.
End users: There is no end user setting or impact for this feature.

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) started on June 22, 2026

Availability

Available to all Google Workspace customers

Resources

Google Workspace Admin Help: View alert details

Google Workspace has upgraded security tracking by expanding its existing “Super Admin password reset” alert into a broader “Admin password reset” alert. This change ensures that any password modification across all privileged administrator roles—not just top-level Super Admins—triggers a notification in the system’s Alert Center. [1, 2]

Key Features of the Expanded Update

Comprehensive Coverage: Tracks credential updates for every administrative tier, maximizing visibility over privileged accounts.
Zero Configuration: Enabled automatically by default; teams do not need to perform any manual setup.
Recipient Retention: Existing custom mailing lists configured for the older rule carry over seamlessly.
Rate Limiting: Built-in protection restricts notifications to 25 events every two hours to prevent alert fatigue.
Zero End-User Impact: This background platform change bypasses regular standard user accounts entirely. [1, 2, 3, 4, 5]

Audit Log and Alert Details

When an administrative password is changed, the Alert Details page documents critical context for security teams: [2]

The Affected Party: Displays the exact email address of the modified administrator account.
The Actor: Explicitly identifies the specific admin or super admin who performed the reset.
The Timestamp: Records exactly when the modification occurred to assist in rapid incident response. [1, 2]

Security Recommendation

Treating all admin updates with identical vigilance helps SOC teams catch compromised credentials and insider threats faster. To make full use of this update, audit your Alert Center configuration to ensure notifications route directly to an actively monitored security alias or SIEM tool. [1, 6]

Enhanced security