Note: This article is on the new Sandbox 2.0 which is currently in Private Beta. For Freshservice's legacy Sandbox click here.

When an account admin creates a Sandbox, all the workspaces (i.e. active and draft ones) are copied into the Sandbox instance. 

Restricted workspaces are also copied by default, however, only agents with admin access to those restricted workspaces get access to the Sandbox.

Workspace admins (of both normal and restricted workspaces) can only view Sandbox from global settings. They can create, edit, delete Sandboxes only from their respective workspaces and not from the global workspace settings. Learn more here.