Google Workspace Offboarding Checklist

A Google Workspace offboarding checklist: suspend the user, sign out sessions, transfer Google Drive ownership, keep mail, then reclaim the licence safely.

Typical schedule per leaver
The checklist 4 sections, 18 items
Variables {{employee_name}} {{user_email}} {{new_owner}}
Start from CI

Use this template Free, no credit card. Imports the checklist into your Runbook organization.

Use this checklist when someone with a Google Workspace account leaves, and your team runs its email, Drive and calendars on Google. It focuses on what Google's admin console does and does not do for you. Run it alongside your general IT offboarding checklist, which covers non-Google systems and devices.

Who owns it

A Workspace super admin or a user admin owns the run. The leaver's manager decides who becomes the new owner of files and mail. Menu names in the admin console change over time, so treat the steps as what to achieve rather than exact click paths.

Common pitfalls

Deleting before transferring. When you delete a user, files they own that were not transferred can be lost. Suspend first, transfer Drive and Calendar data, then delete.
Files in shared drives versus My Drive. Files in shared drives belong to the organisation and stay. Files in the user's My Drive need a transfer.
Suspension still costs a licence. Suspended users usually remain billable. Many teams keep the data by archiving the user or exporting it, then delete the account.
Forgotten app passwords and OAuth grants. Third-party apps with access to the account keep their tokens until you revoke them or the user is suspended. Check them explicitly.
Group ownership. If the leaver owns Google Groups, mailing lists may become unmanageable. Assign new owners.

Starting the run from your HR system means the Workspace steps begin on time, and the completed run shows when each piece of data moved and to whom.

The checklist: Google Workspace offboarding: {{employee_name}}

Prepare

Cut-off time and new owner {{new_owner}} confirmed with the leaver's manager
Drive files owned by {{user_email}} reviewed for anything shared externally
The Drive audit log or the file sharing reports show externally shared files.
Google Groups owned by {{user_email}} reassigned to a new owner

Block access

Password reset to a random value and the user signed out of all sessions
Resetting the password and choosing "sign out" in the user's security settings ends active web and mobile sessions.
2-Step Verification backup codes and security keys removed
App passwords and third-party OAuth app access revoked
Mobile devices with the account wiped or the account removed from them
User suspended in the admin console

Transfer data

Drive and Docs ownership transferred to {{new_owner}}
Use the data transfer feature in the admin console. Transferred files land in a folder named after the leaver in the new owner's Drive.
Calendar events transferred or cancelled, and recurring meetings handed over
Mail kept: delegated, routed to {{new_owner}}, exported, or kept through the archived or retention setup you use
Mail forwarding or an auto-reply configured as agreed optional
Email address added as an alias to {{new_owner}} or a group optional
This keeps important mail arriving after the account is deleted. Check that the alias does not conflict with retention rules.
Mail and Drive data exported if a retention policy or legal hold requires it optional
Google Vault does not keep the data of a deleted user. Export it, or keep the account as an archived user, before deleting.

Close out

Third-party services that used "Sign in with Google" for this account checked and closed
Account deleted or archived on the agreed date, after the transfers completed
Licence reclaimed or reassigned in billing
Manager told which data was transferred and where to find it

Checklist as Markdown

# Google Workspace offboarding: {{employee_name}}

## Prepare
- [ ] Cut-off time and new owner {{new_owner}} confirmed with the leaver's manager
- [ ] Drive files owned by {{user_email}} reviewed for anything shared externally
  The Drive audit log or the file sharing reports show externally shared files.
- [ ] Google Groups owned by {{user_email}} reassigned to a new owner

## Block access
- [ ] Password reset to a random value and the user signed out of all sessions
  Resetting the password and choosing "sign out" in the user's security settings ends active web and mobile sessions.
- [ ] 2-Step Verification backup codes and security keys removed
- [ ] App passwords and third-party OAuth app access revoked
- [ ] Mobile devices with the account wiped or the account removed from them
- [ ] User suspended in the admin console

## Transfer data
- [ ] Drive and Docs ownership transferred to {{new_owner}}
  Use the data transfer feature in the admin console. Transferred files land in a folder named after the leaver in the new owner's Drive.
- [ ] Calendar events transferred or cancelled, and recurring meetings handed over
- [ ] Mail kept: delegated, routed to {{new_owner}}, exported, or kept through the archived or retention setup you use
- [ ] Mail forwarding or an auto-reply configured as agreed (optional)
- [ ] Email address added as an alias to {{new_owner}} or a group (optional)
  This keeps important mail arriving after the account is deleted. Check that the alias does not conflict with retention rules.
- [ ] Mail and Drive data exported if a retention policy or legal hold requires it (optional)
  Google Vault does not keep the data of a deleted user. Export it, or keep the account as an archived user, before deleting.

## Close out
- [ ] Third-party services that used "Sign in with Google" for this account checked and closed
- [ ] Account deleted or archived on the agreed date, after the transfers completed
- [ ] Licence reclaimed or reassigned in billing
- [ ] Manager told which data was transferred and where to find it

Start this checklist from your pipeline

When HR records a leaver, POST /api/v1/runs with template "Google Workspace offboarding: {{employee_name}}" and user_email and new_owner.

curl -X POST https://runbook.metastic.ch/api/v1/runs \
  -H "Authorization: Bearer $RUNBOOK_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"template": "Google Workspace offboarding: {{employee_name}}", "variables": {"employee_name": "…", "user_email": "…", "new_owner": "…"}}'

See the API and the GitHub Action

Frequently asked questions

How do I transfer Google Drive ownership when an employee leaves?

Use the data transfer tool in the Google Workspace admin console. Pick the leaver as the source and a colleague as the new owner, and choose Drive and Docs. The files move to a folder in the new owner's Drive. Do it before you delete the account, because deletion can remove files that were not transferred.

Should I suspend or delete a departed user in Google Workspace?

Suspend first, because it blocks sign-in immediately while keeping the data. Then transfer files and calendars, and keep the mail in the way your retention policy requires. Delete or archive the account afterwards, because suspended users usually keep using a licence.

What happens to email when a Google Workspace user is deleted?

The mailbox is deleted with the account, and Google Vault does not keep data of deleted users. Export the mail first, or keep the account as an archived user, if you need it. If colleagues still need incoming mail, add the address as an alias to another user or a group after deletion.

Updated 2026-11-04