Auto Suspend/Reactivate Users by OU Changes with xFanatical Foresight

Introduction 

This blog explains how to automatically suspend or reactivate Google Workspace users based on changes to their Organizational Unit (OU) using xFanatical Foresight. Managing user access is an important part of Google Workspace administration, especially when employees change roles, leave the organization temporarily or require restricted access due to compliance or security requirements. While Organizational Units help organize users and apply policies, moving users between OUs does not automatically suspend or reactivate their accounts.

As a result, administrators must perform additional manual steps after every OU change. In organizations where users are frequently moved between departments, locations or policy groups, this process can become repetitive and prone to mistakes. Delays in suspending accounts may leave unnecessary access active, while delays in reactivating users can impact productivity and create support requests.

With xFanatical Foresight, administrators can automate user suspension and reactivation based on OU changes. When a user is moved into a designated suspension OU, the account is automatically suspended. When the user is moved out of that OU, the account is automatically reactivated. This automation reduces administrative effort, improves security and ensures user access changes happen immediately and consistently.

Illustration of how xFanatical Foresight automatically suspends and reactivates users based on Organizational Unit changes.

Introducing xFanatical Foresight Automation

xFanatical Foresight is a powerful automation platform designed specifically for Google Workspace. It enables administrators to automate user lifecycle management tasks without manual intervention. Instead of monitoring OU changes and manually updating account status, administrators can create automation rules that respond instantly whenever a user is moved between Organizational Units.

Using xFanatical Foresight, organizations can automatically suspend users moved into a designated suspension OU and automatically reactivate users moved out of that OU. 

Automation Setup Instructions

In this section, we guide you through the automation setup in xFanatical Foresight.  We have 2 ways to set up automation rules, Set up automation from a template and Set up automation from scratch. After completing the automation rule, verify whether the automation meets your requirements.

Set Up Automation From a Template

Set Up Automation From a Template

Supported plans: xFanatical Foresight Elite plan.

The template is designed with two rules to automate user account status management based on Organizational Unit changes:

1. Rule 1: Suspend user by changing OU – This rule automatically suspends a user when the user is moved into a designated suspension Organizational Unit.
   
2. Rule 2: Reactivate user by changing OU – This rule automatically reactivates a suspended user when the user is moved out of the designated suspension Organizational Unit.

Rule 1: Suspend user by changing OU

1. Sign into xFanatical Foresight with your Google Admin account. 
2. Go to the Templates page.
3. Search for Auto suspend/reactivate users by changing users’ OU and click on it.
   
4. In the Templates > Auto suspend/reactivate users by changing users’ OU page, click Copy Rule 1.
   
5. For the first time use of the template rule, an dialog Action needed will display requesting necessary permissions required to copy the rule. Click Connect with Google and authorize the permissions.
6. Upon authorization, a dialog titled Copy of Suspend user by changing OU will display.
7. In the Edit trigger > User’s organizational unit changed screen,
   
   1. In the New organizational unit field, select the path of the OU where users should be suspended. This is the destination OU. For example – /Suspended Users
   2. Click Next.
8. Click Review.
9. In the Review screen,
   
   1. In Rule name, customize the automation rule name.
   2. Click Create.
10. The rule is created in the Rules page.

xFanatical Foresight rule graph illustrating automatic suspension of users based on OU.

Rule 2: Reactivate user by changing OU

1. In the Templates > Auto Suspend/Reactivate Users by Changing Users’ OU page, click Copy Rule 2.
   
2. In the Edit trigger > User’s organizational unit changed screen,
   
   1. In the Present organizational unit field, select the same Organizational Unit used for suspending users in Rule 1. For Example: /Suspended Users
   2. Click Next.
3. Click Review.
4. In the Review screen,
   
   1. In Rule name, customize the automation rule name.
   2. Click Create.
5. The rule is created in the Rules page.

xFanatical Foresight rule graph illustrating automatic reactivation of users when moved out of a designated Organizational Unit.

Set Up Automation From Scratch

Set Up Automation From Scratch

Supported plans: xFanatical Foresight Elite and Professional (Legacy).

Rule 1: Suspend user by changing OU

1. Sign into xFanatical Foresight with your Google Admin account. 
2. Go to the Rules page. 
3. Click the New Rule button.
4. Select User’s organizational unit changed trigger from the Select a trigger screen.
   
5. In the Edit trigger > User’s organizational unit changed screen,
   
   1. In the New organizational unit field, select the path of the OU where users should be suspended. This is the destination OU. For example – /Suspended Users
   2. Click Next.
6. In the Select an action screen, select Suspend user action.
   
7. In the Edit actions > Suspend user screen,
   
   1. In the Primary email field, select the User primary email variable from the User’s organizational unit changed trigger.
   2. Click Review.
8. In the Review screen,
   
   1. In Rule name, give your rule a name for easy identification.
   2. Click Create.
9.  The automation rule is created.

xFanatical Foresight rule graph illustrating automatic suspension of users based on OU.

Rule 2: Reactivate user by changing OU

1. Go back to the Rules page. 
2. Click the New Rule button.
3. Select User’s organizational unit changed trigger from the Select a trigger screen.
   
4. In the Edit trigger > User’s organizational unit changed screen,
   
   1. In the Present organizational unit field, select the same Organizational Unit used for suspending users in Rule 1, which indicates users moving out from a specific OU. For Example: /Suspended Users
   2. Click Next.
5. In the Select an action screen, select Reactivate user action.
   
6. In the Edit actions > Reactivate user screen,
   
   1. In the Primary email field, select the User primary email variable from the User’s organizational unit changed trigger.
   2. Click Review.
7. In the Review screen,
   
   1. In Rule name, customize the automation rule name.
   2. Click Create.
8. The rule is created in the Rules page.

xFanatical Foresight rule graph illustrating automatic reactivation of users when moved out of a designated Organizational Unit.

Notes

• Once the automation rules are established, xFanatical Foresight automatically suspends users moved into the designated suspension Organizational Unit and reactivates users moved out of it.
• The Present Organizational Unit used in Rule 2 should match the Organizational Unit configured in Rule 1.
• Make sure the OU configured in Rule 2 is the same OU that was configured in Rule 1. 
• Each time a rule executes, you will receive a notification in xFanatical Foresight indicating whether the action completed successfully.
• Rule execution may take a few moments depending on synchronization and processing times.
• User suspension revokes access to Google Workspace services but does not delete the user account or its associated data.
• User reactivation restores access to Google Workspace services while retaining all existing account data and settings.
• The user must leave the New organizational unit field in Rule 2 blank to reactivate the user when they moved from specified suspension OU to any other OU. For example - /Suspended users to /IT, /Suspended users to /HR etc.

Conclusion

In conclusion, automating user suspension and reactivation through Organizational Unit changes helps administrators manage access more efficiently and consistently. Instead of performing manual account updates after every OU move, xFanatical Foresight automatically handles the process in real time. This reduces administrative workload, minimizes mistakes and ensures access changes are applied immediately whenever users are moved between Organizational Units. 

Try a 14-day free trial with xFanatical Foresight and manage your tasks.

Related Articles

• Suspend Google Workspace users by Schedule
• How to Bulk Suspend Users in Google Workspace
• Automatically Suspend Inactive Users in Google Workspace
• Export active users in Google Workspace 

For more articles, please visit our website: Articles