FirstTry

Certification guide

AGWA

Associate Google Workspace Administrator: the honest guide

The Associate Google Workspace Administrator exam is the Admin console exam: user lifecycle, OUs, groups, Gmail routing and authentication, Drive sharing and trust rules, Vault and DLP, 2SV and admin roles, mobile and Chrome policy, and the audit logs you troubleshoot from. It is 50 to 60 multiple choice and multiple select questions in two hours, and Google recommends six months of Super Admin experience on Business Plus.

Six sections carry the weight: accounts and Directory at about 20 percent, core services at 23, governance and compliance at 15, security and access at 20, browsers and endpoints at 10 and troubleshooting at 13. Core services and the two identity and security sections together are 63 percent of the exam.

Who Google Workspace Admin is for

A good fit if

  • You administer a Google Workspace tenant and want the credential that matches the job.
  • You run Microsoft 365 or another directory and your organization is moving to Workspace, or you support both.
  • You are an IT generalist at a small or mid-sized company where Workspace administration is one of several hats.
  • You do identity work with Entra ID or Okta and Workspace is one of the applications you provision into.

Probably not, if

  • You have never held a Super Admin role, even on a trial tenant. The exam asks where settings live and what they do, and there is no substitute for having clicked them.
  • You want a security credential. The security section is a fifth of the exam and it is about Workspace's own controls, not about security as a discipline.
  • You need the Professional Google Workspace Administrator. Google retired that exam on 31 December 2024 and this associate credential is its replacement, so if a job description names the professional one, it is describing this.

Is Google Workspace Admin worth it?

For anyone who administers Workspace, yes. The exam guide is unusually close to the daily work, and preparing for it forces a walk through every section of the Admin console that most administrators only visit when something breaks.

It is inexpensive to prepare for: a 14 day trial covers most of the objectives and one Business Plus seat covers the rest, so a candidate who times the trial well pays the exam fee and little else.

It is a weaker purchase for an identity engineer who touches Workspace only as a SAML target. The SSO and provisioning objectives are a small part of the exam and the rest is Gmail, Drive, Calendar and Meet configuration that role will not use.

What the exam actually asks you to do

Multiple choice and multiple select, in Google's own words. No labs, no console access, and nothing to configure during the exam.

Item formats

  • Multiple choice
  • Multiple response

Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. Google Cloud, exam page ↗

Domain breakdown

Managing core Workspace services is the heaviest domain at 23 percent, followed by Managing user accounts, domains, and Directory at 20 percent.

Domain weights are Google's published approximate percentages from the official exam guide (Section 1 ~20%, Section 2 ~23%, Section 3 ~15%, Section 4 ~20%, Section 5 ~10%, Section 6 ~13%). Google publishes tildes (approximate) and the values sum to ~101%. Google does not publish a numeric passing score or a formal retake policy on the certification page.

  • Managing user accounts, domains, and Directory20%
  • Managing core Workspace services23%
  • Managing data governance and compliance15%
  • Managing security policies and access controls20%
  • Managing browsers and endpoints10%
  • Monitoring and troubleshooting common issues13%

Where to focus: Core services (23%) and the two identity-and-security sections (20% each) together are about 63% of the exam, so weight your study toward Gmail routing, Drive sharing, OUs, groups, 2SV, admin roles, and access controls before the smaller endpoint and troubleshooting sections.

Google Cloud: Google Cloud exam guides ↗

Study plans by experience level

Working Workspace administrator

2 to 3 weeksat 5 hours

  1. 1Week 1: read the exam guide as a checklist and mark every setting you have not opened in the last three months. For most working administrators the marked items cluster in Vault, DLP, Drive trust rules, classification labels and context-aware access.
  2. 2Week 2: the marked items in your tenant or a trial. Create a retention rule, a hold, a DLP rule with a custom message, a trust rule and a classification label, and read what each audit log records.
  3. 3Week 3: the troubleshooting section with Email Log Search, message headers in the Admin Toolbox, the Meet quality tool and a HAR file, then a timed practice form.

Microsoft 365 or directory administrator

6 to 8 weeksat 6 hours

  1. 1Week 1: start a 14 day Business Plus trial on a domain you control and set MX, SPF, DKIM and DMARC records for it. Every one of those is on the exam.
  2. 2Weeks 2 to 3: accounts and Directory. Users, OUs, groups of every type, a secondary domain, a domain alias, buildings and resources, and provisioning from a third-party IdP with SAML SSO. Map each to its Entra ID or Active Directory counterpart as you go.
  3. 3Weeks 4 to 5: core services. Gmail routing and compliance rules, Drive sharing defaults and shared drives, Calendar resources and delegation, Meet and Chat settings, Gemini controls and AppSheet.
  4. 4Week 6: governance and security. Vault, DLP, trust rules, Takeout and Data Export, labels, 2SV methods, admin roles, context-aware access, the security center and activity rules.
  5. 5Week 7: endpoints, then troubleshooting with the audit logs, Email Log Search and the status dashboard.
  6. 6Week 8: a timed full-length form, then a second pass over the sections you found unfamiliar.

IT generalist new to Workspace administration

10 to 12 weeksat 6 hours

  1. 1Weeks 1 to 2: the Google Skills learning path for this exam alongside a Business Plus trial on a cheap domain. Set up mail flow first so the trial is doing real work while you read.
  2. 2Weeks 3 to 4: accounts, OUs and groups. Design an OU tree for an imaginary company, create every group type, and practice suspending, restoring, archiving and transferring Drive ownership.
  3. 3Weeks 5 to 6: Gmail. Routing, content compliance, spam and phishing settings, attachment limits, forwarding and POP/IMAP, delegation, footers and quarantines. It is the largest single objective group on the exam.
  4. 4Weeks 7 to 8: Drive, Calendar, Meet, Chat and Gemini settings, then Vault, DLP, trust rules and labels.
  5. 5Weeks 9 to 10: security and access, mobile and Chrome management, with your own phone and browser enrolled.
  6. 6Weeks 11 to 12: troubleshooting from the audit logs and Email Log Search, then two timed practice forms.

Common mistakes

Studying on Business Starter
Vault, advanced mobile management, the security center, DLP and trust rules are not in the lower editions. Google names Business Plus as the recommended experience, and a trial or seat on anything lower leaves three of the six sections unpractised.
Treating governance as a small section
Data governance and compliance is 15 percent, but it is the section working administrators have touched least, and its objectives are specific: retention rules, holds, exports, DLP detectors and actions, trust rules, Takeout controls and classification labels. An evening on each is the difference.
Knowing the settings but not the logs
Troubleshooting is 13 percent and it is almost entirely about reading: Email Log Search, message headers, the audit and investigation tool, the Meet quality tool and the status dashboard. Candidates who configured everything but never diagnosed anything lose these questions.
Skipping the DNS work
MX records, SPF, DKIM and DMARC appear in Gmail configuration and again in troubleshooting delivery problems. A trial on a domain you cannot edit DNS for skips both, and a $10 domain fixes it.
Expecting a score report
Google issues pass or fail only, with no section breakdown, and the associate retake ladder is 14, 60 and then 365 days with four attempts in two years. Prepare all six sections for the first attempt rather than planning to learn from a report that does not come.

What comes after passing

The certification is valid for three years, the renewal window opens 180 days before expiry, and passing puts a 50 percent discount code in your CM Connect account for the renewal attempt.

Renewal means passing the exam again inside the window against the guide current at the time, and Workspace adds admin settings monthly.

Natural next steps are identity-shaped: an Entra ID or Okta credential if provisioning and SSO were the part you enjoyed, or the Associate Cloud Engineer if you want the Google Cloud side of the same console.

The durable part is the troubleshooting habit. Knowing which log answers which question about mail, sharing, sign-in and meetings is what the job asks daily, and it transfers to every other SaaS tenant you will administer.

Costs across the full renewal cycle are on the Google Workspace Admin cost page.

Frequently asked questions

What happened to the Professional Google Workspace Administrator certification?

Google retired the professional exam on 31 December 2024, and its page now says it is ineligible for renewal and points to the Associate Google Workspace Administrator instead. The certification index lists the associate under the same heading as Cloud Engineer and Data Practitioner.

Do I need a paid Workspace tenant to prepare?

Not necessarily. Every Business plan starts with 14 days at no cost, and a well-timed trial on Business Plus covers most of the exam guide. Candidates who need longer can keep a single seat, which Google's pricing page listed at $28.70 a month on 2 September 2026.

How long is the exam and how many questions does it have?

Two hours and 50 to 60 multiple choice and multiple select questions, delivered online-proctored or at a test center, in English or Japanese. Google reports pass or fail only and does not publish a passing score.

Which sections of the Workspace Administrator exam carry the most weight?

Core Workspace services at about 23 percent, then accounts and Directory and security and access at about 20 percent each. Those three are 63 percent of the exam. Governance and compliance is 15, troubleshooting 13 and browsers and endpoints 10.

How does this exam compare with Microsoft's MS-102?

They cover the same job from different vendors. MS-102 spans Microsoft 365 tenant, identity, security and compliance administration; this exam spans the Workspace equivalents, with Gmail routing, Drive sharing, Vault and the Admin console's security center in place of Exchange, SharePoint, Purview and Defender. Administrators who hold one usually find the other's exam guide familiar in shape.

Keep reading

Every guide and cost breakdown, by vendor

Practice Google Workspace Admin for free while you decide

Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.

Start free Google Workspace Admin questions