How to offboard a user in Google Workspace

Suspending a user blocks sign-in immediately while keeping their mail, Drive files, and calendar intact. Deleting a user removes their data after a short recovery window, so do it only once anything you need has been transferred.

Suspension is the right first step on the last day. Deletion comes after data transfer, which is also when the license is freed.

A suspended user generally still counts toward your paid licenses. Plan the transfer and deletion so you are not paying for accounts that are only suspended.

1. 1

   Suspend the user

   In the Admin console, open the user and suspend them. This blocks new sign-ins to Gmail, Drive, and every Google service.

2. 2

   Sign them out of active sessions

   Reset the user's sign-in cookies from their security settings so existing browser and device sessions end, not just future sign-ins.

3. 3

   Revoke app passwords and connected apps

   Remove app-specific passwords and revoke OAuth access for third-party apps the user authorised. These tokens can keep working independently of the password.

4. 4

   Remove them from groups

   Group membership can grant access to shared drives, calendars, and mailing lists. Remove the user from each group, especially ones used for access control.

5. 5

   Handle mobile devices

   For managed devices, remove the account from the device or wipe company data, depending on your mobile management settings.

1. 1

   Transfer Drive files

   Files in the person's My Drive are owned by them. Transfer ownership to their manager or a successor before deletion, or they are removed with the account. Files in shared drives belong to the organisation and are not affected.

2. 2

   Decide what happens to email

   Options include delegating the mailbox to a manager for a period, forwarding with a routing rule, or, after deletion, adding the old address as an alias on another account so customer emails are not lost.

3. 3

   Export or retain mail if policy requires

   If you have legal hold or retention requirements, make sure the mailbox is covered by your retention tool before deleting the account.

4. 4

   Transfer calendar events

   Recurring meetings the person owned can be transferred so they do not disappear from other attendees' calendars.

• Delete the user once data transfer is confirmed, which frees the license.
• Check shared passwords or service accounts the person had access to and rotate them.
• Review the Admin console audit log for unusual downloads or sharing changes shortly before departure.
• Update any mail routing, groups, or aliases that pointed at the old address.

Suspending a Google account stops "Sign in with Google" to other apps, but accounts that were created in those apps with a password, or synced through another identity provider, stay active. Tools like GitHub, AWS, or Figma often need separate removal. The same is true of files shared from personal accounts, which Google Workspace admin controls cannot reach.