Identity & SSO
PurpletGo + Google Workspace
30-day free trial - no credit card required
What it does
What PurpletGo does in Google Workspace
Suspend a departing employee's Google Workspace account, sign them out everywhere, and revoke the app access they granted, as part of their offboarding.
- Suspends the user account, blocking sign-in to Gmail, Drive, and other Google services.
- Signs the user out of all active Google sessions.
- Removes the user from their Google groups.
- Revokes the access tokens of third-party apps the user authorised with their Google account.
- Uses those app grants to suggest other apps to revoke for the same person.
- Reads the account back to confirm it is suspended, with no app tokens or group memberships left. Anything left makes the result failed, with what remains.
- Optionally transfers the user's Drive files, shared and private, to the manager's email on the offboarding once access is removed (off by default, turned on in the Google Workspace settings).
- Runs when an admin or HR user revokes access for the offboarding, alongside the other systems selected for that person, and the result is recorded as revoked, failed, or needs manual action, with the reason.
What you need
- A Google Workspace Super Admin account to approve the connection.
- The Admin SDK API enabled for your Google Workspace domain.
Plan
All plans
Compare plansSetup
Set up Google Workspace in PurpletGo
- 1
Open Integrations, find Google Workspace, and click Connect.
- 2
Confirm your PurpletGo password (and two-factor code if enabled).
- 3
Sign in with a Super Admin account and approve the requested permissions.
Good to know
- The user is matched by the work email on their offboarding.
- Connections made before group removal was added need to be reconnected once to grant group access; the Integrations page shows a prompt when this applies.
- Connections made before Drive transfer was added need to be reconnected once to grant the data transfer permission; the Integrations page shows a warning when the transfer is on and the permission is missing. The manager must be a user in the same Google Workspace. A transfer that fails does not change the revocation result: admins are notified to finish it in the Google Admin console.
- Under legal hold, the account is still suspended and signed out, but group memberships are kept and the Drive transfer waits until the hold ends.
- Handling the mailbox (delegation, routing, aliases) and calendar stays in the Google Admin console.
Why this matters
A former employee with an active Google Workspace session can still read company email and open shared Drive files for hours after their last day if suspension is left to a manual to-do list.
Doing this by hand? Read how to offboard a user in Google Workspace.
Google Workspace FAQ
Common questions about the Google Workspace integration
What does PurpletGo do in Google Workspace?
Suspend a departing employee's Google Workspace account, sign them out everywhere, and revoke the app access they granted, as part of their offboarding.
Why does revoking Google Workspace access matter when someone leaves?
A former employee with an active Google Workspace session can still read company email and open shared Drive files for hours after their last day if suspension is left to a manual to-do list.
Which PurpletGo plan includes the Google Workspace integration?
All plans.
What do I need to connect Google Workspace to PurpletGo?
A Google Workspace Super Admin account to approve the connection. The Admin SDK API enabled for your Google Workspace domain.
Related
Related Identity & SSO integrations
Offboard with every system accounted for
Some integrations need the Team or Enterprise plan, shown above.
30-day free trial - no credit card required