# Org, workspace and system roles and permissions

*Slack Consultant Study Guide · Policies and Settings · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-consultant/policies-and-settings/org-workspace-and-system-roles-and-permissions*

What each admin role can do at the workspace and org level (Primary Owner, Owner, Admin), which tasks are org-only in an Enterprise org, who resets 2FA, and how system roles and custom roles delegate narrow admin tasks under least privilege.

- Certification: Salesforce Slack Consultant
- Exam section: Policies and Settings
- Study guide: https://www.certifyforce.com/study-guide/slack-consultant

**Official exam objective:**

> Understand the administrative roles within Slack and their permissions for Slack settings.

## What the exam expects

- Distinguish Primary Owner, Owner and Admin at the workspace level, including who manages billing and who can delete or transfer a workspace.
- Identify the tasks that belong to Org Owners and Org Admins in an Enterprise org (deactivation, new workspaces, IdP groups, domain claiming) and the ones only Org Owners hold (SSO configuration).
- Route a 2FA lockout to the role allowed to reset it.
- Pick the system role that delegates a task under least privilege, and know who assigns system roles and that guests can't hold them.
- Recommend a custom role when no system role fits, and know who creates it.

Key terms:
- **Primary Owner**: the single highest-privilege person in a workspace or org; only they transfer ownership.
- **Org Owner / Org Admin**: Enterprise org administrators above the workspace roles; Org Admins manage org-level settings and policies.
- **System role**: a predefined admin permission set (such as Users Admin) assigned to full members or IdP groups.
- **Custom role**: an Enterprise-only admin role built from chosen permissions.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Delete or transfer a workspace | Workspace Primary Owner only | [Types of roles](https://slack.com/help/articles/360018112273-Types-of-roles-in-Slack) |
| Workspace Admins and billing | Can't access the Billing page or manage billing details | [Types of roles](https://slack.com/help/articles/360018112273-Types-of-roles-in-Slack) |
| Transfer org ownership | Org Primary Owner only | [Types of roles](https://slack.com/help/articles/360018112273-Types-of-roles-in-Slack) |
| Configure SSO in an Enterprise org | Org Owners; Org Admins only manage SSO exclusions | [Manage SSO settings](https://slack.com/help/articles/220403548-Manage-single-sign-on-settings) |
| Deactivate an account in an Enterprise org | Org Owner/Admin, not Workspace Owner/Admin | [Permissions by role](https://slack.com/help/articles/201314026-Permissions-by-role-in-Slack) |
| Turn off 2FA for a Workspace Owner | Workspace Primary Owner only | [Mandatory 2FA](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication) |
| Turn off 2FA for a Workspace Admin | Workspace Owners only | [Mandatory 2FA](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication) |
| Who can hold system roles | Members and IdP groups, not guests or Frontline Members | [Assign system roles](https://slack.com/help/articles/1500004132581-Assign-members-to-system-roles) |
| Who assigns org-level system roles | Org Primary Owner and org-level Roles Admins | [Assign system roles](https://slack.com/help/articles/1500004132581-Assign-members-to-system-roles) |
| Who creates custom roles | Org Primary Owner and org-level Roles Admins (Enterprise plans) | [Create custom roles](https://slack.com/help/articles/29800891169939-Create-custom-roles) |

## Check yourself

- Why does a Workspace Admin fit someone who manages members but must not see billing?
- When an Org Admin opens SSO settings, what can they change?
- Which system role lets someone manage who holds system roles without becoming an Org Owner?
- Who can turn off 2FA for a locked-out Workspace Owner?

## Sources

- [Types of roles in Slack](https://slack.com/help/articles/360018112273-Types-of-roles-in-Slack)
- [Permissions by role in Slack](https://slack.com/help/articles/201314026-Permissions-by-role-in-Slack)
- [Get to Know Org-Level Administrative Account Types](https://trailhead.salesforce.com/content/learn/modules/slack-workspace-and-org-level-roles/get-to-know-org-level-administrative-account-types)
- [Understand the Primary Owner role](https://slack.com/help/articles/360038161033-Understand-the-Primary-Owner-role)
- [Assign members to system roles](https://slack.com/help/articles/1500004132581-Assign-members-to-system-roles)
- [Create custom roles](https://slack.com/help/articles/29800891169939-Create-custom-roles)
- [Mandatory workspace two-factor authentication](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication)
- [Manage single sign-on settings](https://slack.com/help/articles/220403548-Manage-single-sign-on-settings)
- [Slack plans and features](https://slack.com/help/articles/115003205446-Slack-plans-and-features)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 9 linked practice questions, and unlimited timed mock exams are included with the Slack Consultant pack (USD $19): https://www.certifyforce.com/practice-exams