Secure Google Workspace Admin Offboarding Checklist: Data Transfer, Delegation & Revocation

Executive Summary: The Security Risks of Improper Offboarding

When an employee departs an organization, improperly offboarding their Google Workspace account creates severe enterprise vulnerabilities: unrevoked active OAuth sessions can grant third-party apps ongoing access to corporate data; shared Google Drive files owned by the user risk permanent deletion; and inbound client emails sent to their inactive address bounce without notice.

A secure deprovisioning workflow requires a structured, multi-phase technical protocol. In this guide, we provide a step-by-step checklist for Google Workspace Super Admins to transition data ownership, terminate active sessions, delegate inboxes, and preserve compliance audit logs before deleting user licenses.

The Complete 7-Step Admin Offboarding Checklist

Step 1: Immediate Session Revocation & Password Reset

The moment employee termination takes effect, immediately block account access to prevent data exfiltration:

1. Log into Google Admin Console.
2. Navigate to Directory > Users and select the user.
3. Click Security > Reset password and generate a secure randomized password.
4. Click Security > Sign-out cookies > Reset to instantly revoke all active web and mobile browser sessions.
5. Scroll down to Connected applications and click Revoke all OAuth tokens.

Step 2: Transfer Google Drive and Calendar Ownership

Never delete a user before transferring their Google Drive ownership. If a user owns templates, spreadsheets, or folders shared across departments, deleting the user permanently moves those assets to the trash.

• In Admin Console, go to Apps > Google Workspace > Drive and Docs > Transfer ownership.
• Enter the departed user's email as the From User and the designated team lead as the To User.
• Click Transfer Files. Google transfers all file ownership into a dedicated folder in the recipient's Drive.

Step 3: Preserve Inbound Email via Gmail Forwarding or Delegation

To ensure customer inquiries are not lost:

• Option A (Email Alias): If freeing up the Workspace license immediately, convert the user's primary email address into an alias on a department manager's account or a Google Group.
• Option B (Mail Delegation): Delegate access to the mailbox so a manager can inspect historical correspondence without knowing the user's password.

Step 4: Archive Vault Compliance & Legal Hold Data

If your organization is subject to HIPAA, SOC 2, or regulatory compliance mandates, verify whether the user's data is covered by active Google Vault retention matters before reassigning licenses. Assign an Archived User (AU) license to preserve vault discovery without paying full Workspace suite pricing.

Step 5: Revoke 2FA Security Keys & Backup Codes

Remove enrolled hardware security keys (FIDO2 / YubiKey) and invalidate 2-Step Verification backup codes under Security > 2-Step Verification.

Frequently Asked Questions

How many days do I have to restore a deleted Google Workspace user?

Google Workspace allows administrators to restore a deleted user and recover their Drive and Gmail data within 20 days of deletion. After 20 days, all user data is permanently purged and unrecoverable.

What happens to Google Meet recordings when a user is deleted?

Google Meet recordings are saved directly into the user's Google Drive inside a folder named Meet Recordings. Transferring Drive ownership preserves all historical video recordings.

Can I transfer ownership of Shared Drives?

Shared Drives are owned by the organization rather than individual users. Ensure at least two active team members hold Manager permissions on the Shared Drive before offboarding.

Security Deep-Dive: Identity Lifecycle Management (ILM) & Revocation Protocols

Modern enterprise security frameworks (ISO 27001, SOC 2 Type II, CIS Benchmarks) mandate automated, auditable deprovisioning processes. When an employee departs, lingering access tokens, unrevoked application passwords, and third-party SaaS single sign-on (SSO) authorizations represent prime vectors for unauthorized enterprise data access.

Complete 10-Point Technical Deprovisioning Protocol

1. Force Immediate Password Invalidation: Generate a 32-character randomized password string.
2. Sign Out of All Browser Sessions: Wipe mobile device management (MDM) work profiles and revoke browser cookie sessions in Google Admin Console.
3. Revoke Connected OAuth Applications: Invalidate third-party app access tokens under the user's security profile.
4. Suspend User Account: Temporarily suspend the account during data migration to block all incoming SMTP and POP/IMAP protocols.
5. Transfer Google Drive Ownership: Execute administrative transfer of all Drive documents, forms, and sheets to a designated team custodian.
6. Transfer Google Calendar Events: Reassign active and recurring calendar invites to prevent orphaned company-wide meetings.
7. Reassign Inbound Email Deliverability: Route incoming messages to an administrative group alias or setup automated forwarding.
8. Preserve Google Vault Retention Matters: Verify no active litigation holds require the mailbox to be preserved prior to license deallocation.
9. Revoke Hardware Security Tokens: Delete registered FIDO2 / WebAuthn keys and 2-Step Verification backup codes.
10. Downgrade to Archived User (AU) License: Reassign the user to an Archived User tier to maintain Vault e-discovery while reclaiming expensive Workspace enterprise licenses.

Auditing User Access Logs in Google Workspace Reports

Before purging a user, inspect their activity log under Admin Console > Reporting > Audit and investigation > User log events. Filter for recent bulk file downloads, shared drive permission changes, and external sharing events to verify that no proprietary data was exported prior to departure. See our Google Workspace Small Business Guide for administrative best practices.

Security Audit Trails: Exporting Evidence for SOC 2 and ISO Compliance

Deprovisioning is not complete until auditable compliance documentation is safely exported and archived. Regulatory frameworks require organizations to demonstrate that departed employee accounts were closed within designated timeframes (typically within 24 hours of termination).

Exporting Audit Records via Google Admin SDK Reports API

System administrators can query the Reports API using Google Cloud CLI or Apps Script to capture the complete deprovisioning timeline:

# Query Admin Audit Log for account suspension and token revocation events
gcloud logging read 'logName="projects/YOUR_PROJECT_ID/logs/cloudaudit.googleapis.com%2Factivity" AND jsonPayload.eventName=("SUSPEND_USER" OR "REVOKE_TOKEN")' \
  --limit=20 \
  --format="table(timestamp, jsonPayload.actor.email, jsonPayload.eventName, jsonPayload.target.email)"

Handling Mobile Devices and Google Endpoint Management

If the departed employee enrolled a personal or company-owned smartphone in Google Workspace Endpoint Management:

• Work Profile Wipe (BYOD Devices): Select the device in Admin Console > Devices > Mobile & endpoints and choose Wipe work profile. This deletes only corporate emails, Drive files, and corporate apps while preserving the employee's personal photos, contacts, and personal data.
• Device Wipe (Company-Owned): If the smartphone is corporate property, execute a full factory reset wipe before collecting physical hardware.