Google Reseller access to Resold domains
If by contract your reseller provides you with full customer support, you don’t have the ability to enable or disable their access to your Admin console. The following information doesn't apply to you.
If your reseller isn't contractually obligated to provide full support to you, their access to your Admin console is granted by you. The Reseller Tools Console enables a Google Apps for Work reseller to identify and administer to a customer’s domain(s). Reseller administrator access is enabled by default. If you’ve elected to have a Google Reseller manage your domain, you should assume that your reseller has complete access to your domain. Reseller access to your domain includes, but is not limited to, the ability to provision or remove users, edit user details, reset user passwords, and edit organizational units and groups. This list of capabilities is not complete.
To disable a reseller’s access to your domain and to restrict their administration abilities:
- Sign in to your domain’s Admin console
- Select Company Profile
- Select Profile
- Uncheck the Reseller Access box
https://support.google.com/a/answer/4556884?hl=en