Updated 4 November 2026 by Simon Mestdagh, founder of Caspian.

To offboard someone from Google Workspace, do it in this order: set up mail handover, reset the password and sign-in cookies, revoke OAuth tokens and app passwords, remove recovery options, take them out of Groups and shared drives, transfer Drive and Calendar, suspend, then delete or archive the account after 30 to 90 days. Google covers those steps. It does not cover the apps people signed into with Google, apps without SCIM, Slack channels and GitHub repos, or the Mac. This checklist covers all of them, with a read-back step at the end so you know each removal happened.

Key takeaways

• Do the handover first, then lock-out, then clean-up, then delete.
• Set mail routing and delegation before you suspend, because a suspended account blocks new mail.
• Delete or archive the account 30 to 90 days after the last day; deleting also deletes Vault-held data.
• Google does not cover apps signed into with Google, apps without SCIM, Slack channels, GitHub repos or the Mac. The checklist below does.

Caspian publishes this page and sells a product in this space. Where we give an opinion, we say so. Google's help pages were checked on 4 November 2026.

What is the right order for a Google Workspace offboarding?

The right order is handover first, then lock-out, then clean-up, then delete. A suspended account blocks new mail and calendar invitations, so mail routing and delegation must be set before you suspend (Google Workspace help). Deletion is last because it destroys Gmail for good, and Google says deleting a user also deletes their Vault-held data (Guanacos Tech, summarising Google help).

For a planned leaver, the sequence is:

1. Before the last day, list their apps, groups, shared drives and devices. Pick who receives mail and files.
2. On the last day, reset password, reset cookies, revoke tokens, remove recovery details, remove groups.
3. The same day, transfer Drive and Calendar, set delegation or an alias, suspend.
4. Within the hour, remove them from every other app, Slack and GitHub included.
5. 30 to 90 days later, delete the account or assign an Archived User licence.

For an involuntary leaver, swap steps 1 and 2. See the section on involuntary leavers below.

How do you lock a leaver out of Google Workspace?

You lock a leaver out by resetting the password, resetting sign-in cookies, and removing every second way in. Google's own list for a departing user is: wipe mobile devices, remove recovery email and phone, change the password, revoke OAuth 2.0 tokens, reset sign-in cookies, revoke security keys and app passwords, then delete the account (Google Workspace help).

Click paths in the Admin console:

• Reset password: Menu, Directory, Users, select the user, Reset password.
• Reset sign-in cookies: the same user page, Security, Sign-in cookies, Reset.
• App passwords, security keys, 2-Step Verification: user page, Security. Revoke each entry.
• Recovery email and phone: user page, User information. Clear both so the leaver cannot use password recovery.
• Admin roles: user page, Admin roles and privileges. Remove every role, so nothing returns if the account is restored.

A password reset revokes OAuth tokens for some Google products, not all of them (Google Workspace help). That is why the next step exists.

Which apps did the leaver sign into with Google?

The apps a leaver signed into with Google are listed under the OAuth grants on their account, and you find them in two places. On the user page, Security, Connected applications lists each app with access and lets you revoke it. Across the company, Menu, Security, Access and data control, API controls, Manage App Access shows accessed apps with user counts and the Google scopes each app uses (Google Workspace help).

Two limits matter. Google says app details "typically appear 24 to 48 hours after authorization", so a tool the person connected yesterday may not show yet. And revoking the token only stops the app from reading Google data. The account inside the app stays. A leaver who signed into Notion, Figma or an AI tool with Google still has that account, and a live session in it, until someone removes it in the app.

For a history of grants, use Menu, Reporting, Audit and investigation, OAuth log events. It records each authorization with the app name, client ID, scopes and user (Google Workspace help). Export that list for the leaver: it is your list of apps to close.

How do you remove a leaver from apps without SCIM?

You remove a leaver from apps without SCIM through the app's admin API, its admin console, or a task for the app owner. Suspending the Google account blocks new single sign-on. It does not deactivate the account inside each app, and it does not touch apps where the person used a password. Many vendors put SCIM on top plans only: Slack on Business+ and Enterprise (Slack help), Notion on Enterprise (Notion help).

For each app on the OAuth list and each app in your own register:

1. Open the app's admin page and find the leaver by email.
2. Transfer what they own, such as boards, projects, repos, files.
3. Deactivate the account. Delete later.
4. Free the paid seat.

This is the manual step a free scan removes. Caspian, the IT automation platform for scale-ups, lists every app each person uses, including apps signed into with Google and apps outside your identity provider, so you start from a full list instead of building one by hand. Start for free: self-serve, no card needed. The routes for automating the removal itself are in offboarding without SCIM.

What about Slack channels and GitHub repos?

Slack channels and GitHub repos need their own step, because Google has no view into either. In Slack, a Workspace Admin deactivates the member under Admin, Workspace settings, People (Slack help). Deactivation removes them from all channels and signs them out on every device. Before that, give the channels they managed a new Channel Manager.

In GitHub, the leaver's personal account survives your offboarding, because GitHub accounts belong to the person. Remove them from the organization, which ends their access to private repos. Then check three things they may own: repos you need to transfer, personal access tokens that ran company automation, and deploy keys they added. Rotate any secret they could read.

The full Slack and Google steps, including who has the rights to run each one, are in automate Slack and Google Workspace access. This checklist links there rather than repeating them.

How do you transfer Drive, Calendar and Gmail?

You transfer Drive and Calendar with the data transfer tool and Gmail with delegation, an alias or a migration. For Drive, go to Menu, Apps, Google Workspace, Drive and Docs, Transfer ownership, enter the From and To users, and click Transfer Files (Google Workspace help). Google's notes: suspend the owner first, items in Trash are not transferred, a transfer running past 36 hours fails, and the previous owner can still edit until removed. Calendar events transfer from Menu, Account, Data transfer.

Files in shared drives belong to the organization and stay put. Remove the leaver from each shared drive instead.

For Gmail, pick one:

• Delegation: turn on Mail delegation under Apps, Google Workspace, Gmail, User settings, then add the manager as delegate on the user. Fast, temporary.
• Alias: add the old address as an alias on the successor after deletion. Google allows up to 30 aliases per user (Guanacos Tech).
• Forwarding or address map: set it before suspension. Address map changes can take up to 24 hours (Patronum).

Also check the leaver's own Gmail settings for forwarding to a personal address and remove it.

When should you suspend, delete or archive the account?

Suspend on the last day, then delete or archive after a fixed hold of 30 to 90 days. Suspension keeps all data and can be undone, but "suspended accounts are still charged" on both Annual and Flexible plans (Google Workspace help). A suspended account is a hold, not an end state. Put the delete date in the calendar on the day you suspend.

Option	Sign-in	Data	Billing	Use when
Suspend	Blocked	Kept	Full price	Hold during handover, 30 to 90 days
Archived User licence	Blocked	Kept, searchable	Archived licence price	You must keep mail and files
Delete	Gone	Gmail lost, Drive recoverable 20 days with the account	Licence freed	Handover done, no legal hold

Before deleting, check Vault and legal holds. Deleting the account deletes the user's Vault-retained data too (Guanacos Tech).

License reclaim is the step that saves money: on Annual plans the freed licence can be reassigned, on Flexible plans you stop paying for it. Do the same for every paid seat in other apps.

What do you do with the leaver's Mac?

You lock or wipe the Mac, recover it, and remove it from your device management. If the Mac is enrolled in an MDM, send a lock on the last day for an involuntary exit, or a wipe once the person has returned it and the data is handed over. Before a wipe, check that Activation Lock is off or that you hold the bypass code, or the Mac cannot be set up again. Remove it from Apple Business Manager only when you sell or retire it.

If the Mac is not enrolled, you cannot wipe it remotely. That is the BYOD case: rely on the password reset, cookie reset and token revocation above, and ask for the laptop back. Google's endpoint wipe covers mobile devices and endpoints it manages (Google Workspace help), not a Mac outside Google's device management.

Record the serial number, the date returned and the wipe date. An auditor will ask.

How do you prove each removal happened?

You prove each removal by reading the app again after the change and recording what you see. A change is not done when you click Deactivate. It is done when the app's user list shows the leaver as deactivated or gone. For each app:

1. List the users.
2. Find the leaver by email.
3. Record the state and the time, such as deactivated, removed, seat freed.
4. If the account is still active, reopen the step.

In Google, re-run the OAuth log search for the leaver a week later and check for new grants or API calls. In Slack and GitHub, search the member list. Keep the results with the ticket.

NIST SP 800-53 control PS-4 asks you to disable access within a set time, revoke credentials, and keep access to the information the person controlled (PS-4). A list of observed states with times is the evidence for that control in an ISO 27001 or SOC 2 review.

What changes for an involuntary leaver?

For an involuntary leaver, you cut access first and hand over data after. Schedule the lock-out for the moment HR tells the person, not the end of the day. In order:

1. Reset password, reset sign-in cookies, revoke tokens, app passwords and security keys, remove recovery details.
2. Suspend the Google account.
3. Deactivate Slack and remove them from the GitHub organization.
4. Lock the Mac through your MDM.
5. Rotate shared credentials and API keys they could read, such as password manager vaults, deploy keys, cloud console keys.
6. Then run the handover, with the Drive transfer, Calendar transfer, mail delegation.

Suspension leaves data intact, so the handover still works after the lock-out (Google Workspace help). The only steps that must come before suspension, mail routing and address maps, can be set by an admin on the account afterwards; new mail sent in the gap may bounce.

The checklist

Copy this into your ticket or a shared doc.

#	Step	Where	Owner	Done
1	Confirm last day and time	HR system	HR	☐
2	Export the leaver's OAuth grants	Reporting, Audit and investigation, OAuth log events	IT	☐
3	List apps outside Google sign-in	App register or discovery tool	IT	☐
4	Set mail delegation or forwarding	Gmail, User settings, Mail delegation	IT	☐
5	Remove personal forwarding rules	Leaver's Gmail settings	IT	☐
6	Reset password	Directory, Users, Reset password	IT	☐
7	Reset sign-in cookies	User, Security, Sign-in cookies	IT	☐
8	Revoke connected apps, app passwords, keys	User, Security	IT	☐
9	Clear recovery email and phone	User, User information	IT	☐
10	Remove admin roles	User, Admin roles and privileges	IT	☐
11	Remove from Groups, reassign owned groups	Directory, Groups	IT	☐
12	Remove from shared drives	Drive, shared drive members	IT	☐
13	Transfer Drive files	Drive and Docs, Transfer ownership	IT	☐
14	Transfer Calendar	Account, Data transfer	IT	☐
15	Suspend user	Directory, Users, Suspend user	IT	☐
16	Deactivate Slack, hand over channels	Slack Admin, People	IT	☐
17	Remove from GitHub org, transfer repos	GitHub org People	Eng lead	☐
18	Deactivate in every other app	Each app's admin page	IT / app owner	☐
19	Rotate shared secrets they could read	Password manager, cloud consoles	IT	☐
20	Lock or wipe the Mac, record serial	MDM	IT	☐
21	Read back every app, record state and time	Each app's user list	IT	☐
22	Free paid seats	Each app's billing	IT	☐
23	Check Vault and legal holds	Google Vault	IT / Legal	☐
24	Delete or archive after 30 to 90 days	Directory, Users	IT	☐

What does Caspian read, and with which rights?

Caspian reads metadata and settings, not content. It reads which apps exist, who has an account, which role that account has, and the state of each laptop. It does not read file contents, email bodies or chat messages. Connections are read-only by default; Caspian asks for write rights only for the steps you switch on, such as removing a leaver's account. Customer data is stored with AWS in the EU (Frankfurt). An independent pen test is planned, and ISO 27001 and SOC 2 are in progress.

Simon Mestdagh, founder of Caspian, wrote this page. We make Caspian, one of the tools discussed here.

FAQ

Does suspending a Google Workspace user stop billing?

No. Google says suspended accounts are still charged on Annual and Flexible plans. Deleting the account, or moving it to an Archived User licence, stops the regular charge.

Does suspending a Google account remove access to apps signed in with Google?

No. It blocks new sign-ins with Google, but accounts and open sessions inside those apps stay. Revoke the OAuth tokens in Google and deactivate the account inside each app.

Where do I see which third-party apps a user connected with Google?

On the user page under Security, Connected applications, and company-wide under Security, API controls, Manage App Access. OAuth log events under Reporting give the history with scopes.

How long should I wait before deleting a leaver's Google account?

Most teams hold 30 to 90 days after suspension. Delete only after Drive, Calendar and mail are handed over and no Vault or legal hold applies, because deletion removes Gmail for good.

What changes when the leaver is let go involuntarily?

Cut access first: reset password and cookies, revoke tokens, suspend, deactivate Slack and GitHub, lock the Mac. Run the data handover afterwards, since suspension keeps the data.

Start for free. Self-serve, no card needed. Or add Caspian to Slack, Teams or Google Chat.

← All resources