Site Administrator access is appropriate for someone trusted to control the whole Site. It gives full authority over files, users, settings, integrations, and Workspaces. A person who maintains transfers can direct files to another destination without opening them in the web app, so control over those transfers is part of access to the data.

Site-wide Authority

Folder permissions and Workspace boundaries do not narrow a Site Administrator's authority. Adding a smaller folder grant or granting administration of one Workspace does not turn an existing Site Administrator into a more limited administrator. Remove Site Administrator access when the intended responsibility is limited to selected resources.

Workspace Administrators can manage a team's files, users, and integrations within its Workspaces. Folder Admins can administer selected folders. Group Admins can maintain eligible users and memberships using the capabilities the Site enables. Choose those permissions according to the work the person needs to perform.

The content restrictions of finalized Snapshots and Archive Only Mode still apply to Site Administrators, including Parent Site Administrators working on Child Sites. Full administrative authority does not make those protected contents editable.

Authority Over Child Sites

Every Parent Site Administrator has full Site Administrator authority on every Child Site, regardless of who created it. There is no setting that removes or reduces that authority while the person remains a Parent Site Administrator. Child Site permissions and separate SSO configuration cannot exclude them.

Child Site Management Policies can lock settings while someone works within a Child Site. Parent Site Administrators can change or remove those policies from the Parent Site, so the policies do not limit their ultimate authority. This is a fixed part of the Parent and Child Site design.

Keep Parent Site Administrator access to the minimum necessary and protect those users with two-factor authentication and careful control of their credentials. A person responsible for selected Child Sites can receive Child Site Administrator access without becoming a Parent Site Administrator.

Administrative Access explains assignment. Administrative Permission Changes explains why withdrawing an administrative grant does not undo the resources or access it previously established.