Automate offboarding workflows in Google Workspace 

Update recovery phone 

A recovery phone number allows former employees to regain access to their old account, even after you’ve reset their password. To prevent unauthorized access through the password recovery feature, it’s recommended to remove the recovery phone number.

You can do this in the Google Admin Console by navigating to:
Users > [user’s name] > Security > Recovery information > Phone.

Setup instructions

1. In the Select a action step, select Update recovery phone trigger.
   
2. In the Edit actions > Update recovery phone screen, in the User primary email field, select the User primary email variable from the drop down list.
   
   1. In the User primary email field, select the User primary email variable from the User’s organizational unit changed trigger.
   2. Leave the Phone number field blank to remove the recovery phone associated with the account.

Update recovery email

Similar to a recovery phone number, a recovery email allows users to regain access to their accounts if they forget their password or get locked out.

To prevent former employees from regaining unauthorized access after leaving your organization, it’s important to remove their recovery email from your Google Workspace domain.

You can do this in the Google Admin Console by going to:
Users > [user’s name] > Security > Recovery information > Email.

Setup instructions

1. In the Select an action screen, select the Update recovery email action.
   
2. In the Edit actions > Update recovery email screen,
   

Revoke third-party application accesses

Employees may use their Google Workspace accounts to sign in to third-party applications (e.g., Google Workspace Marketplace apps). Once authorized, these apps retain access to your organization’s data until explicitly revoked—either by the user or an administrator.

To review and revoke access, go to the Google Admin Console:
Users > [user’s name] > Security > Connected applications.

Learn more about viewing and removing access to third-party applications.

Note: Removing an app’s access does not prevent a former employee from reauthorizing it if they can still sign in to their Google account.

Setup instructions:

1. In the Select an action screen, select the Delete user tokens action.
   
2. In the Edit actions > Delete user tokens screen,
   
   1. In the User primary email field, select the User primary email variable from the User’s organizational unit changed trigger.
   2. Check the Delete all checkbox. This will automate revoking all accesses to all connected applications for the given user.

Reset user password 

Resetting the password of a departing employee is a critical step in minimizing the risk of unauthorized access to their account. This action not only secures the account but also automatically revokes access to third-party applications previously authorized by the user.

As such, password reset is an essential part of the off-boarding process. Learn more about resetting a user’s password.

To reset a user’s password, go to the Google Admin Console:
Users > [hover over the user] > Reset password.

Note: Use Generate password action to generate a secure and random password automatically and use the output variable in the next action.

Setup instructions:

1. In the Select an action screen, select Reset user password action.
   
2. In the Edit actions > Reset user password screen,
   
   1. In the User primary email field, select the User primary email variable from the User’s organizational unit changed trigger.
   2. In the New password field, select the Generated password variable from the Generate password action.
   3. In the Require a password change at the next sign-in field, select true.

Revoke 2-Step Verification (2SV) backup codes 

2-Step Verification (2SV) adds an extra layer of protection against unauthorized access—even if a user’s username and password are compromised. One common 2SV method is the use of backup codes.

If a departing employee still possesses their password and backup codes, they may still be able to access their old account. To prevent this, it’s important to revoke any existing backup codes as part of the off-boarding process. Learn more about using backup codes for account recovery.

You can manage this in the Google Admin Console under:
Users > [user’s name] > Security > 2-step verification.

Setup instructions:

1. In the Select an action screen, select the Invalidate backup codes action.
   
2. In the Edit actions > Invalidate backup codes screen,
   
   • In the User primary email field, select the User primary email variable from the User’s organizational unit changed trigger.

Revoke App Passwords 

An App Password is a 16-digit passcode used by less secure apps to access your Google account when Sign in with Google is not supported. While this is an uncommon setting for most modern apps, it’s important to check and manage it during the off-boarding process.

To revoke or manage App Passwords, go to the Google Admin Console:

Users > [user’s name] > Security > Application-specific password.

Learn more about signing in with App Passwords.

Setup instructions:

1. In the Select an action screen, select the Delete app passwords action.
   
2. In the Edit actions > Reset user password screen,
   
   1. In the User primary email field, select the User primary email variable from the User’s organizational unit changed trigger.
   2. Check the Delete all checkbox. This will automate revoking all app passwords for the given user.

Delete all user email aliases

Email aliases allow users to receive messages sent to multiple email addresses within a single Gmail inbox. When an employee leaves the organization, it’s important to remove or reassign their email aliases to ensure no important communication is lost.

You can manage aliases in the Google Admin Console by navigating to:
Users > [user’s name] > User information > Email aliases.
Learn more about Google Workspace email aliases.

Setup instructions:

1. In the Select an action screen, select the Delete user email aliases action.
   
2. In the Edit actions > Delete user email aliases screen,
   
   1. In the Primary email field, select the User primary email variable from the User’s organizational unit changed trigger.
   2. Check the Delete all checkbox. This will automate deleting all user email aliases.

Revoke Super Admin role 

If a departing employee holds Super Admin privileges, it’s essential to revoke their access to protect your organization’s data and maintain administrative security.

The Update Super Admin Status action allows you to either assign or revoke Super Admin privileges for a user. In the context of off-boarding, this action should be used to remove the user’s super admin role as part of the security protocol.

Setup instructions:

1. In the Select an action screen, select the Update super admin status action.
   
2. In the Edit actions > Update super admin status screen,
   
   1. In the Primary email field, select the User primary email variable from the User’s organizational unit changed trigger.
   2. In the Assign super admin field, select false.

Hide user in the directory 

When an employee leaves the organization, it’s best practice to hide their contact information from the organizational directory to signal the personnel change to others.

Once hidden, the user’s profile will no longer appear in email auto-complete, Google Contacts, or Cloud Search results, helping prevent confusion and maintain a clean directory.

Learn more about how to hide a user from the directory.

Setup instructions:

1. In the Select an action screen, select the Update user directory sharing action.
   
2. In the Edit actions > Update user directory sharing screen,
   
   1. In the Primary email field, select the User primary email variable from the User’s organizational unit changed trigger.
   2. In the Share user in the directory field, select false.

Remove user from all groups

It’s important to remove a departing employee from all Google Groups to prevent unauthorized access to group-shared resources such as shared drives, files and calendars.

This can be done manually in the Google Admin Console by viewing and editing the user’s group memberships.

Learn how to view a user’s group memberships.

Setup instructions:

1. In the Select an action screen, select the Remove user from all groups action.
   
2. In the Edit actions > Remove user from all groups screen,
   
   • In the Primary email field, select the User primary email variable from the User’s organizational unit changed trigger.

Create data transfer request 

When an employee leaves, they often have GBs of important work stored in their Google Drive. Since this data belongs to the company, it’s a smart move to transfer ownership to their manager before deleting the account.

You can do this using the Create data transfer request action, which moves their Drive files, Calendar events, Brand Accounts, and Looker Studio reports to another active user, like their direct manager. This works just like the Transfer user’s data option you see when deleting a user in the Google Admin Console.

Setup instructions:

1. In the Select an action screen, select the Create data transfer request action.
   
2. In the Edit actions > Create data transfer request screen,
   
   1. In the From user field, select the User Primary Email variable from the User’s organizational unit changed trigger.
   2. In the To user field, select the Manager email variable from the Get user info action.
   3. In the Select data to transfer field, check the application data to be transferred.

Archive user

Once you’ve revoked all access to a departing employee’s Google account, the next step is to archive the user account. Unlike deleting a user, which permanently erases their data, archiving retains all user data while removing access.

Learn more about archiving users in the Google Admin Console.

Setup instructions:

1. In the Select an action screen, select the Archive user action.
   
2. In the Edit actions > Archive user screen,
   
   • In the Primary email field, select the User primary email variable from the User’s organizational unit changed trigger.

Suspend user

After revoking a departing employee’s access and backing up their data, the next step is to suspend their account. Suspending a user is a temporary measure and can be reversed, allowing the account to be reactivated later if necessary. During suspension, all data remains intact, ensuring no loss of important information.

Learn more about temporarily suspending a user.

Setup instructions:

1. In the Select an action screen, select the Suspend user action.
   
2. In the Edit actions > Suspend user screen,
   
   1. In the Primary email field, select the User primary email variable from the User’s organizational unit changed trigger.

Delete user 

Deleting a user account is usually the final step in the offboarding process. Once a user is deleted, Google begins permanently removing their data, so it’s important to use the Delete User action.

Make sure all necessary data transfers and security steps are completed before taking this step. In the Google Admin Console, you can delete a user by going to Users > [hover over a user] > Delete user.

Learn more about deleting a user in the Google Admin Console.

Setup instructions:

1. In the Select an action screen, select the Delete user action.
   
2. In the Edit actions > Delete user screen,
   
   1. In the Primary email field, select the User primary email variable from the User’s organizational unit changed trigger.

Notify stakeholders 

It’s also crucial to keep yourself and other key stakeholders (such as the employee’s manager) informed throughout the offboarding process. For instance, you can set up an initial notification to alert yourself when the offboarding process begins, and a final notification to confirm the employee has been successfully offboarded, notifying both you and the employee’s manager. These notifications are sent via email. 

Note: Use the Get user info action to retrieve the user’s details, including their manager’s email to streamline the notification process.

Setup instructions:

1. In the Select an action screen, select the Email action.
   
2. In the Edit actions > Email screen,
   
   1. In the To field, select the Manager email variable from the Get user info action.
   2. In the Subject field, enter a custom subject line that clearly indicates the purpose of the email.
   3. In the Email body field, compose a personalized message that includes relevant details about the offboarded employee.