Safely Offboard Google Workspace Users Leaving your Company in 5 Steps

Safely Offboard Google Workspace Users Leaving your Company (2)

See GAT Labs
in action

Table of Contents

How to safely offboard Google Workspace users?

User offboarding is one of the most critical admin tasks because of the Google Workspace security implications it entails. Think of potential angry leavers and data protection obligations.

Also, for larger organisations, user offboarding can be a pain as it involves more admin time and effort that can be better put towards more urgent tasks.

That’s why many admins come to us asking how to safely offboard Google Workspace users.

If you’re an admin looking for a better way to safely offboard leaving users and save time on repetitive offboarding tasks, then tune in, this post is for YOU.

 

STEP 1: REVOKE ACCESS

When you offboard Google Workspace users you first need to revoke their access to critical company resources and data in Google Workspace. 

Account

  • Force sign out.
  • Change account password.
  • Change or delete the recovery phone or email (Otherwise leavers may still be able to access the account even after you’ve reset its password)

Email

  • Reset their mailbox password.

Drive

  • Do a quick log review of the account’s activity to check for sharing via link actions or personal accounts.
    (This will show you if the user changed files into a public link or added their personal email account to files as a collaborator to still access them after leaving the company)

Devices

  • Wipe the account from all mobile, ChromeOS devices, or any other devices the leaving user has been using.
    (That of course depends on your company’s device policy.)

Two-Step Verification (2FA)

    • If the user has two-step verification enabled make sure to delete all 2FA codes.

Groups

    • Delete the leaving user from all Google Workspace groups.

Third-Party Apps

    • Review and disable third-party apps or services linked to their Google account.

 

STEP 2: DELEGATE & TRANSFER

Afterwards ensure proper file transferring and delegation of particular areas to avoid business interruptions, that includes:

Drive

Drive is one of the most important areas to pay attention to to ensure Drive DLP, information security and avoid file recovery issues.

If the department you’re offboarding users from uses Shared Drives, you don’t need to worry much about file ownership as files are owned by the Drive (team) rather than the person who created them.

 

HOWEVER, with important MyDrive files you’ll want to:

Email

OR

  • Create an auto-reply message directing all inquiries to the employee’s manager/ or another team member. 

OR

  • Delegate account access to the user’s manager via the Gmail Settings Panel.

PRO TIP: To flag and catch emails sent to an alias without leaving the account active:

  1. Add the leaving users’ email as an alias to their manager. That way emails sent to the deleted user will go to their manager’s inbox. 

OR

  1. Rename the account, then create a group with the old name and set it to accept messages from any (or trusted) domains.

Ex. John@enc.com becomes John-disabled@enc.com (user is actually suspended), meanwhile, the new group is named ‘John’.

Calendar Events

This may be particularly important for client-facing roles that normally have important calls or Calendar events in the future.

    • Copy Calendar events to a new user/ manager.

OR

    • Delete their Calendar events.

Contacts

    • Copy or transfer the leaving user’s contacts to another user so no important contacts are lost.

 

STEP 3:  DELETE OR SUSPEND ACCOUNT

Now it’s time to decide whether you want to delete or suspend your user.

If you decide to:

Delete the account

This permanently removes everything from that user’s account, Email, Calendar events, etc. 

It also removes every MyDrive file they’ve created, so make sure you’ve transferred everything you need before deleting the account.

 

Suspend the account

This allows you to retain the user’s files, emails, etc. while blocking new emails & calendar invites and disabling login access.

After you’ve sorted out everything and made sure no data loss or operational interruptions would occur (usually takes a few months) you can then delete the account.

Remember, when suspending accounts you’ll still be charged for their license.

 

STEP 4: SAVE YOUR OFFBOARDING ACTION-SETS

Time for the BEST PART!

 After you’ve identified the action sets you’d like to take when offboarding users, save them as customized offboarding workflows for future use — You can use a Google Workspace automation tool to achieve that.

Every department can then have its own workflow to use again and again when offboarding users.

 

STEP 5: AUTOMATE YOUR OFFBOARDING WORKFLOWS

Automate your offboarding workflows to be triggered by an event (such as when a new user is added to a Group or Organization Unit (OU), or to be recurrent or scheduled.

This will help you offboard Google Workspace users across your organisation with ease, and cover the most important areas with a few clicks.

 

BULK USER OFFBOARDING

You can also perform bulk offboarding actions for multiple users that way — saving plenty of admin time (offboarding a group of interns or when shutting down an entire department).

 

CONCLUSION

User Offboarding automation saves admin time, effort, and BOOSTS security.

 

Tell us more about YOU! — What are the most challenging areas you face when onboarding, offboarding or modifying your Google Workspace users?

Write to us at help@gatlabs.com, we’ll be happy to help.

 

Stay in the loop

Sign up to our newsletter to get notified whenever a freshly baked blog post is out of our content oven.

Related Posts

Admin

True or False? 4 Questions for Google Workspace Admin

Google Workspace Admin may have and receive a lot of questions about this tool and we totally understand that – it’s a complex package of …

Read More
Cybersecurity

What We’d Need to Remember after Cybersecurity Awareness Month

Attention, your computer has been infected! Did you get goosebumps or, at least, a lump in your throat when reading the above line? No one …

Read More
Try this Life-Changing Google Workspace Admin Hack
Admin

Try this Life-Changing Google Workspace Admin Hack

Here’s the one hack every Google Workspace admin needs to know: Automate all the things – Why waste time and effort on tasks that can …

Read More
Admin, are you Monitoring these Cloud Security Risks?
Cloud Security

Admin, Are you Monitoring these Cloud Security Risks?

Do you know which are the most significant cloud security risks and how to deal with them? In a cloud-centric world of instant data sharing …

Read More