Email is the account that traps freelancers most often, and it traps them for an honourable reason: the client needs working email on Friday, they don't have a company address yet, and you're the only person in the room who knows what an MX record is. So you create the Workspace, and you create it under the login you happen to be signed into.
Two years later you're the super admin of a company's email. That role can read, reset and delete every mailbox in the business. Nobody asked you to hold that, you didn't want it, and unwinding it is now a conversation rather than a checkbox.
Here is the version that avoids it, and the way out if you're already in it. For the mechanics of moving the account itself, see the Google Workspace handover guide.
Why does being the admin matter so much?
Because email is the account everything else resets through.
If you hold a client's hosting, they lose a server. If you hold their email, they lose the ability to recover anything else: the domain, the analytics, the payment processor, the bank alerts. Every reset link in that business arrives at a mailbox you control.
It's also the account with the most sensitive contents, and the super admin role isn't a lesser version of access. It's total. Holding it for a client you like is still holding it, and if there's ever a dispute you're a person with unrestricted access to the other side's correspondence. That's exposure, not leverage.
How do I set it up so the client owns it from day one?
"The client owns it" and "you do the typing" aren't in conflict. Ownership is decided by which addresses sit in three fields, not by whose hands are on the keyboard.
Create the tenant on the client's domain. Not a subdomain of yours, not a placeholder you intend to move later. The domain is what makes the tenant recoverable by the client, because Google's recovery process for a lost admin account works by proving control of the domain.
Make the first admin account a client address. Something like admin@theirbusiness.com, created during setup. Not your Gmail, not you@youragency.com. This one field is most of the work.
Put the client's recovery email and phone on that account. These are separate fields from the admin address and they are easy to skip during setup. A recovery phone number is a master key: whoever holds the phone can take the account. Your mobile number on a client's admin account means the account leaves with you, silently, and neither of you'll remember it's set that way.
Then add yourself as a second admin, on your own address, with the narrowest role that lets you do the work. Google's admin console has pre-built roles below super admin, including user management, help desk and groups, and most freelance work fits inside them. You want the role you can be removed from in ten seconds, not the one that requires a handover.
Billing goes on the client's card. If you genuinely have to pay in the first month, write down that you did and the date, and treat it as a debt to clear rather than an arrangement. Payment method and admin rights are separate in Workspace, so paying doesn't require owning.
Google moves things around in the admin console regularly, so I am deliberately naming fields rather than menu paths. The fields have been stable for years. The paths haven't.
What about buying it through a reseller?
You get a margin and the client gets one less card to enter, and both of those are real.
What you also get is a client who can't leave without your cooperation. That sounds like retention until the week you're ill, or you wind the business down, or you simply don't answer for a fortnight, at which point a company's email is downstream of your availability. Some freelancers take that trade knowingly. Take it knowingly, then, and say so in writing. Don't end up there because the reseller box was ticked by default at signup.
I am already the super admin. How do I get out?
In this order, and none of it is difficult once the client has an address on their own domain.
- Create the client-owned admin account if it doesn't exist,
admin@theirbusiness.com, and give it the super admin role. - Move the recovery email and phone on that account to the client's. Do this before anything else, because recovery is what makes the rest safe.
- Have the client sign in and change the password themselves. If you know the password to the account you're handing over, you haven't handed it over.
- Move billing to their payment method.
- Downgrade your own account from super admin to the smallest role that lets you keep working, or delete it if the work is finished.
- Tell them plainly what changed and why. "You're now the owner of your own email, and I have the access I need to support it, which you can remove at any time" is a sentence that makes clients trust you more, not less.
Step five is the one people postpone, and it's the only one that actually removes the liability.
What does this look like when it's done right?
The client can lose you and keep their business. You can lose the client and keep your reputation. Nobody has to ask anybody for a password.
Three fields decide it: which domain the tenant is on, which address is the admin, and where recovery goes. Get them right on the day you set it up and there's nothing to unwind later.