How to offboard a Google Workspace user: a checklist that actually locks them out

When someone leaves, the instinct is to click Suspend and move on. That blocks new sign-ins, but a complete offboarding also deals with the credentials and sessions that already exist, and with the files and calendar events the person owned. Here is the order that works, with where to find each step in the Google Admin console, and how to do it all in one go from your Mac.

1. Reset the password

In the Admin console open Directory → Users, pick the user and choose Reset password. Set a long random value and keep the "ask for a password change at next sign-in" box ticked. This stops anyone who knows the old password, including the leaver, from signing in if the account is ever restored, and nobody needs to remember the new one.

2. Revoke third-party app access

People connect Google accounts to all sorts of tools with "Sign in with Google". Each of those grants is an OAuth token that can keep working independently of the password. On the user's Security page, open Connected applications (the exact label varies as the console changes) and revoke each one. Doing this before suspension means you can still see what the user had connected.

3. Sign the user out of all sessions

On the same Security page choose Sign out (or Reset sign-in cookies). Sessions on the web and on phones stay valid until they are terminated, so a changed password alone doesn't kick out a laptop that is already signed in. If you use the open-source GAM tool, the equivalent is:

gam user jane@example.com signout

4. Suspend the account

Now suspend. A suspended user can't sign in, but their data, mail and Drive files stay in place and, as of writing, the licence still counts against your bill until you delete the account or remove it. With GAM:

gam update user jane@example.com suspended on

Suspension is reversible, which is why it is the right default. Deleting the account is a separate decision that you should make only after the data has been handed over.

5. Move them to a leavers org unit (optional)

If you apply policies by organisational unit, move the user to a "Leavers" OU so any sharing or app restrictions you keep there apply, and so they are easy to find when it's time to delete them.

6. Transfer their Drive files and Calendar events

Under Account → Data migration → Data transfer in the Admin console you can transfer ownership of Drive files and Calendar events from one user to another. The transfer runs in the background and Google emails you when it's done, so don't delete the old account until it has finished. Mail is not part of this transfer; if someone needs the old mailbox, delegate it or export it separately.

Why the order matters

• Revoking apps and signing out are the steps that cut off access that already exists; suspension alone relies on Google noticing the change.
• Doing them before suspending means any step that needs a working account (such as listing the apps they connected) succeeds.
• The data transfer comes last because it takes the longest and doesn't block anything else.

Doing the whole list in one click from the menu bar

Rollcall turns the checklist above into a single confirmed run from your Mac's menu bar. Search for the person, open Offboard and it works through these steps in order: reset the password (a random one, copied to your clipboard, with a forced change at next sign-in), revoke every third-party app, sign out all sessions, and suspend. Optionally it moves the user to an org unit you name and starts a Drive and Calendar transfer to a colleague you choose; Google emails you when that transfer finishes. If one step fails, the others still run, and you get a per-step result so you know exactly what to finish by hand.

Rollcall talks directly to Google's Admin SDK using an OAuth client ID you create in your own Google Cloud project, so nothing passes through our servers. Searching users, viewing details and the dashboard are free; the actions, including Offboard, are part of Rollcall Pro, which you can try for 7 days.

Google, Google Workspace and Google Drive are trademarks of Google LLC. Rollcall is an independent app and isn't affiliated with or endorsed by Google. See also Google's guide to transferring data.