A secure Google Workspace offboarding process should separate immediate access shutdown from later data-retention and account-deletion decisions. Reset credentials and sessions, suspend or archive access, remove group and Shared Drive memberships, revoke third-party authorization, transfer business data, preserve mail and files according to policy, review licenses, and delete the account only after retention and legal requirements are satisfied.
What’s in this guide
Why Google Workspace offboarding needs a defined IT checklist
HR and IT have different responsibilities during offboarding. HR typically owns the employment process, exit documentation, and communication. IT is responsible for shutting down technical access and making sure business data remains under company control.
The risky part is not only a deliberately malicious former employee. Access can remain active because a session was never invalidated, a user stayed in a Google Group or Shared Drive, a third-party app retained authorization, or a file-transfer step was skipped. Those gaps can become an information-leak risk in Google Workspace.
The safest approach is to make offboarding a repeatable lifecycle process with a clear trigger, owner, execution order, and completion record. For more background on how offboarding gaps affect access security, see this Google Workspace offboarding and data-leak research.
Google Workspace gives admins several account states and data-retention options. The right sequence depends on your retention policy, Vault or legal-hold requirements, licensing model, and whether data must be transferred to another employee before the account is removed.
10-step Google Workspace employee offboarding checklist for IT
Confirm the departure event, timing, and retention requirements
Get a reliable HR trigger before changing access
Confirm the employee’s final access time, manager, department, account identifier, and whether HR, Legal, Finance, or Compliance has any retention requirements. The trigger should be explicit enough that IT is not relying on an informal message or calendar reminder. If your offboarding process uses a dedicated Leaver organizational unit, Google’s Admin documentation explains how to move users between organizational units.
For larger environments, this is where Google Workspace user lifecycle automation can connect the HR event to a governed offboarding workflow.
Reset the password and invalidate active sign-in sessions
Stop continued access through existing credentials and sessions
Reset the user’s password and reset sign-in cookies so active Google Workspace sessions are invalidated. Google documents both steps in its password-reset and sign-in-cookie guidance. If your organization uses a third-party identity provider or SSO, disable access there as part of the same departure event.
Review recovery methods and authentication credentials
Remove ways the former employee could regain or extend access
Review account-recovery information and security methods that remain associated with the user. Depending on your configuration, this can include recovery details, security keys, app passwords, and other sign-in methods that should no longer remain valid. Google’s user security settings documentation covers the Admin controls available for managed accounts.
Revoke third-party authorization and privileged access
Remove OAuth tokens, delegated rights, and elevated roles
Revoke third-party OAuth tokens and app passwords where applicable, and remove any administrative privileges, delegated access, or elevated roles assigned to the account. Google’s security-settings documentation is a useful reference for managed-user credentials, while Admin role documentation covers removing elevated privileges. For external SaaS applications, revoke access in the systems your offboarding process is configured to manage rather than assuming every account is discovered automatically.
Suspend or archive the account
Block sign-in while you complete the data and retention work
Suspension is useful when IT needs to block access immediately while preserving the account for follow-up work. Archiving is a separate option for former employees when your Workspace edition and licensing support Archived User accounts. Archived users cannot sign in, while their Workspace data can be retained according to the organization’s configuration. See Google’s Archived User guidance for edition, licensing, and retention details.
Remove Groups, Shared Drive memberships, and delegated access
Clean up permissions that live outside the user account itself
Remove the employee from Google Groups and Shared Drives, then review direct file access and any delegation the user held. Google documents removing members from Groups and how access works in Shared Drives. Shared Drive files remain owned by the organization, but membership and directly granted permissions still need to be reviewed so the former employee no longer has access through the account or another identity.
This step is closely related to ongoing Google Workspace access reviews, because stale group and file permissions are easier to prevent when access is reviewed regularly rather than only during offboarding.
Transfer or preserve My Drive and other business data
Keep company-owned information before deletion or license changes
Transfer business files the departing employee owns in My Drive to the appropriate owner before deleting the account. Google confirms that Workspace administrators can transfer Drive ownership in bulk. Also decide how Gmail, Calendar, and other service data should be retained, migrated, exported, or archived under your organization’s policy.
Files in Shared Drives are different: they belong to the organization rather than to the individual user, so they remain in the Shared Drive after the employee leaves. Google’s Shared Drive documentation explains this ownership model.
Set up business continuity for email and calendar
Decide what happens to incoming communication after departure
Depending on the role, you may need to route incoming email, establish a temporary delegate, configure an out-of-office response, transfer calendar ownership, or notify external contacts. Treat these as business-continuity decisions rather than leaving the former employee’s active account in place simply to receive messages.
Review licensing and the retention model
Do not remove a license before deciding what data must remain available
License changes should follow the data-retention plan. Google notes that removing a user’s Workspace license can put data at risk; an Archived User license is designed for retaining former-employee data when supported by your edition. Cloud Identity Free can be useful for identity-only scenarios, but it should not be treated as a universal substitute for an offboarding archive strategy. For license administration, see Google’s assign, remove, and reassign licenses documentation and its Archived User guidance.
Delete the account only after retention and legal checks are complete
Deletion is the final lifecycle step, not the access-control step
Delete the account only when required data has been transferred or preserved and any Vault retention, legal hold, or compliance requirements have been cleared. Google’s user-deletion documentation explains what happens to account data and which data can be transferred during deletion. Google allows a recently deleted user to be restored for a limited period, but that recovery window should not be used as a retention strategy.
Suspend, archive, or delete? They solve different problems
Blocks the user from signing in while leaving the account and data in place. Useful during the transition while IT completes transfer and review steps.
Designed for former employees when Archived User licensing is available. The user cannot sign in, while organizational data can remain retained.
Removes the account. Transfer or preserve required data first, and check Vault or legal-hold obligations before deletion.
Which Google Workspace offboarding steps can be automated?
Most repetitive administration around offboarding can be automated once the policy is clear. The goal is not to automate judgment away; it is to make sure the agreed steps occur in the right order and that exceptions are routed to a person instead of being silently skipped.
HR or IT trigger intake, password/session actions, suspension, group removal, Shared Drive membership changes, file transfer, license actions, notifications, data logging, and scheduled deletion checks.
Retention periods, legal holds, whether a mailbox must be preserved, who becomes the new data owner, and whether access exceptions are allowed should be defined by policy and reviewed where necessary.
See the broader guide to Google Workspace admin task automation, Zenphi’s Google Admin automation capabilities, and IT operations automation for other lifecycle and administration workflows.
Start with Zenphi’s Offboarding & Deprovisioning Space template
For offboarding, the best place to start in Zenphi is the Offboarding & Deprovisioning Space template. It is already structured as a complete offboarding system rather than a single workflow, so IT teams can configure the process around their own OUs, retention policy, data owners, license rules, and archive destination instead of assembling every component from scratch.
What is included in the Space template?
The template is made up of several workflows plus the data and reporting components needed to track the process.
The primary orchestrator. It starts when an administrator moves a user to the designated Leaver OU, then runs the configured account-securing, data-archiving, group-removal, license-removal, and suspension steps in sequence.
A subflow that retrieves the Google Directory groups assigned to the departing user and removes the user’s memberships to revoke group-level access.
A subflow that creates a Google Vault export for the user’s email data, waits for the export to complete, and transfers the archive files to Google Cloud Storage for long-term retention.
A subflow that removes the assigned Google Workspace license after the retention and export conditions defined in the process have been satisfied.
- Offboarding Records / Process Tracking Table: stores processed offboarding records, user details, timestamps, execution status, and historical workflow data.
- Offboarding Overview & Analytics: shows current metrics, workflow run histories, and status updates across processed accounts.
A Workflow template contains one workflow. Offboarding needs several coordinated flows plus shared data and operational reporting, so this package is delivered as a Space template containing multiple workflows, the Offboarding Records table, and the Offboarding Overview dashboard.
How to find the template
Before running the template, authorize the required Google Directory, Google Vault, and Google Cloud Storage connections. Confirm that the Leaver OU and final Terminated OU match the organizational structure in your domain, and configure the destination email for Drive data plus the Cloud Storage bucket used for exported archive files.
Useful Google setup references: move users between organizational units, Google Vault retention and exports, and create a Google Cloud Storage bucket.
Every action in the template can still be reconfigured
The template is a starting point, not a locked offboarding product. Each Zenphi action remains configurable, so admins can change the OU names, file owners, groups, retention destination, waiting periods, license logic, notifications, approval gates, and the order in which the steps run.
How the template handles Vault export and license removal
The Vault subflow creates the export, waits for Google Vault to finish preparing it, then transfers the archive files into the configured Google Cloud Storage bucket. This is useful when the organization wants a separate retained copy before the next lifecycle step. For a detailed implementation discussion, see Google Vault export automation.
The license-removal subflow is intentionally separate so the organization can decide when it is safe to release a paid Workspace seat. If license cost is a material part of your offboarding program, see the example of optimizing archived-user licenses to save $60,000 per year.
For a broader walkthrough of the setup, see the employee offboarding automation guide.
Have an offboarding process that still depends on a manual checklist?
Map the trigger, account actions, data-transfer rules, approvals, retention steps, and final deletion criteria first. If automation makes sense, Zenphi can be used to implement that process around Google Workspace and the systems you already use.
Google Workspace employee offboarding: FAQ
Should I suspend or delete a departing employee’s Google Workspace account?
For most offboarding processes, immediate access control and final deletion should be treated as separate decisions. Suspension can block sign-in while IT transfers data and completes the checklist. Archiving can be appropriate when former-employee data must be retained and Archived User licensing is available. Deletion should happen only after required data and retention obligations have been addressed. Zenphi can automate the sequence if you want those state changes tied to a governed offboarding workflow.
What happens to a user’s Drive files when the account is deleted?
Files owned by the user in My Drive should be transferred or otherwise preserved before deletion if the organization needs to keep them. Files in Shared Drives are owned by the organization rather than by an individual user and remain in the Shared Drive. Zenphi can include file-transfer and Drive-permission actions in a broader offboarding workflow so those steps are not left to memory.
Does changing a user’s password sign them out everywhere?
Google recommends resetting the user’s sign-in cookies after a password reset to invalidate active sessions. Offboarding should also cover other authentication and authorization paths such as OAuth tokens, app passwords, SSO, security keys, and delegated access. Zenphi can automate the Google Workspace actions that are available in the workflow while routing exceptions or external-system steps to the appropriate owner.
Can Google Workspace employee offboarding be fully automated?
Many repetitive administrative steps can be automated, but the policy decisions still need to be defined by the organization. Retention, legal holds, ownership of transferred data, exceptions, and the timing of deletion may require human or policy-driven decisions. Zenphi is the Google Workspace-native no-code option for orchestrating those automated and human steps in one workflow.
Can I remove a Google Workspace license immediately when an employee leaves?
Do not remove a Workspace license until you have decided how the user’s data will be retained. Google warns that license removal can affect data availability and recommends archiving former employees when retention is required and Archived User licensing is supported. Zenphi can include license changes later in the offboarding sequence after data-transfer and retention conditions have been checked.