Password Recovery & Credential Changes
Giving someone responsibility for user profiles can also give them control over how those users regain access. A primary email address receives password recovery links, while separate permissions govern direct password changes and second-factor management. Review these routes together when choosing who may maintain a user's identity and credentials.
Email as a Recovery Channel
An account's primary email address is also its password recovery channel. A Group Admin with editing enabled for that account, or any Partner Admin for that user's Partner, can change that address. Group Admins cannot change the email address of an account with Site Administrator, Read-only Site Administrator, or Workspace Administrator access on their own site, even with a matching Primary Group. When email recovery is enabled for a password-based account, the administrator can direct a recovery link to a mailbox they control and use it to set a new password, even without permission to change passwords directly. Granting control over email addresses therefore also delegates control over this route to account recovery.
For example, disabling a Partner's direct credential-change capability does not make its users' recovery mailboxes independent of the Partner Admin. The administrator can still edit the primary email address. The direct password-change control and the recovery route govern different ways of setting a password.
Password Recovery and Second Factors
Password recovery does not remove enrolled 2FA methods. Signing in still requires the user's second factor and the normal sign-in checks. An authenticator app or hardware key provides a check independent of the mailbox; email verification relies on that same mailbox. If you rely on this separation, review the administrator's ability to reset enrolled methods and, for Partner Admins, override the 2FA requirement.
Authentication Method and Site Policy
SSO users recover access through their identity provider. Users configured for Email signup receive a signup email instead. Disabling the site's Password recovery via email setting stops email password recovery and invalidates outstanding recovery links, but does not remove delegated email editing, permitted authentication-method changes, or direct credential management.
Email Changes and Existing Access
Changing an email address invalidates outstanding recovery links and ends the user's other active sessions. A user changing their own address keeps the session making the change; an administrator changing another user's address ends that user's active sessions. No change notice goes to the previous address. A later password-changed notice goes to the current address, so the previous mailbox is not an independent record of administrative changes.
An email change should not be treated as complete credential revocation. API keys, SSH keys, shared resources, and previously delivered information have their own rules. Access Revocation explains the controls for ending those forms of access.
Administrative Controls
Group Admin capabilities and Partner Admin Settings determine which direct credential operations those administrators may perform. Their authority to edit email addresses matters alongside those optional controls. Passwords explains configuration, user password changes, and recovery; Re-authentication explains confirmation of the acting administrator for selected sensitive changes.