Google Workspace User Lifecycle: Onboarding and Offboarding Automation Guide

Every employee hire and departure is an IT event. In Google Workspace, a missed onboarding step means a user can’t do their job on day one. A missed offboarding step means a former employee may still have access to company data. Getting user lifecycle management right protects the business and saves IT teams from reactive firefighting.

This guide covers the complete user lifecycle (from account creation to permanent deletion) with Admin console steps, checklists, data-retention options, licensing considerations, and automation at each stage.

---

The Lifecycle at a Glance

---

User Provisioning: Account Creation

Manual creation

For small organizations or low hiring volume, the Admin console works well:

1. Admin Console → Directory → Users → Add new user
2. Fill in first name, last name, and primary email
3. Choose the correct organizational unit. This decides which settings and apps apply
4. Set a temporary password (and require a change at first sign-in) or auto-generate one
5. Choose how to send sign-in instructions

Bulk creation via CSV

For cohort starts or seasonal staff:

1. Admin Console → Directory → Users → Bulk update users
2. Download the CSV template
3. Fill in the required columns: First Name [Required], Last Name [Required], Email Address [Required], Password [Required], Org Unit Path [Required]
4. Upload and review the preview before confirming

Use the same template later for bulk changes such as moving people between OUs.

Directory sync (GCDS)

For organizations with Active Directory or another LDAP directory as the source of truth, Google Cloud Directory Sync (GCDS) creates users when they appear in AD, updates them when attributes change, and suspends them when they’re disabled. See our GCDS setup guide.

Provisioning from your identity provider

If you use Okta, Microsoft Entra ID, or OneLogin, turn on provisioning in the IdP’s Google Workspace app. The IdP then creates, updates, and suspends Workspace users through Google’s APIs when you assign or remove the app. This is configured in the IdP, not in the Google Admin console. Our SSO guide covers how it fits with single sign-on.

Choosing a method

---

Onboarding Checklist

Once the account exists, a consistent checklist makes the user productive on day one:

Use groups for access, not individuals. If shared drives, calendars, and SSO apps are granted to groups, onboarding becomes “add the user to three groups”, and offboarding removes access automatically when they’re removed or suspended.

Automate the repetitive parts. Google Apps Script or the Admin SDK can add new users to standard groups based on department or OU when their account is created.

---

Role Changes: The Forgotten Stage

Most access problems come from people who changed teams, not people who left. When someone moves roles:

• Move them to the new OU so the right policies apply
• Remove old team groups, then add the new ones (removal is the step that gets skipped)
• Hand over shared drive manager roles and calendar ownership they no longer need
• Review admin roles if they were delegated any

A quarterly review of group membership by team leads catches what slips through.

---

Offboarding: The Critical First Hours

The moment a departure is confirmed, IT should follow a runbook. Google’s own guidance for keeping data secure after an employee leaves covers these steps.

Immediate actions (day of departure)

1. Wipe or remove mobile devices: from the Admin console, wipe the device or just the work profile/account on a personal device
2. Remove recovery information: clear the user’s recovery email and phone number so they can’t reset the password
3. Change the password: this also revokes some OAuth tokens
4. Revoke OAuth tokens: in the user’s Security panel, review connected applications and revoke access
5. Reset sign-in cookies: signs the user out of active sessions on all devices
6. Revoke security keys and app passwords: remove anything that could still authenticate
7. Suspend the account: first transfer any secondary calendars the user owns (step 9), because suspending a user now also suspends their secondary calendars. Then go to Directory → Users → select the user → Suspend user

Suspension blocks access to all Google services while keeping the data. Don’t delete on day one.

Data preservation (days 1–5)

8. Transfer Drive files: Apps → Google Workspace → Drive and Docs → Transfer ownership, or during deletion. Files in shared drives belong to the organization and stay put.
9. Hand over calendars: transfer ownership of the user’s secondary calendars before the account is suspended or deleted, then release booked rooms (also offered at deletion)
10. Handle incoming mail: add an auto-reply or route mail to a manager or shared mailbox for a set period
11. Replace shared drive managers: if the user was the only manager of a shared drive, add a replacement
12. Preserve mail if required: use Vault retention, an Archived User license, or migrate the mailbox into another account before deletion

Access cleanup (days 5–30)

13. Remove from groups: stops group mail delivery and removes inherited access
14. Check third-party apps: Security → Access and data control → API controls, and the apps listed in the user’s account (our Marketplace apps guide covers reviewing installed apps)
15. Reassign licenses: reclaim the license once the account is deleted or archived
16. Close accounts in non-SSO apps: anything not covered by your IdP or SAML apps

Account deletion (after retention requirements are met)

Delete only after data has been transferred or preserved and Legal has confirmed no litigation hold applies. When you delete a user, the Admin console offers to transfer their Drive files and primary calendar data to another user. Secondary calendars, including group calendars, are deleted with the user unless you transferred them first. A deleted user can be restored for 20 days; after that, anything not transferred is permanently removed.

---

Keeping Former Employees’ Data: Your Options

Whichever you choose, write it into your retention policy so the decision isn’t made case by case.

---

Handling Sensitive Departures

For involuntary terminations, the protocol changes:

• Complete the immediate actions at the same moment HR informs the employee: agree the exact time in advance
• Document every action with a timestamp for HR and Legal
• Place a Vault hold before deleting anything if a dispute is possible
• Don’t set up automatic forwarding of the former employee’s mail to another person without HR and Legal sign-off; privacy rules vary by country

---

Automating the Lifecycle

Directory or IdP sync: with GCDS or IdP provisioning, disabling the user in AD or Okta suspends the Workspace account automatically. This is the most reliable automation for organizations with a central directory.

Google Apps Script: an HR Google Form can trigger a script that suspends the user, resets the password and sign-in cookies, and opens an IT ticket for the remaining steps.

Workflow tools: Okta Workflows and third-party SaaS management platforms offer prebuilt Google Workspace offboarding flows with approvals and audit logs.

Audit your process: each quarter, compare the HR leavers list with active Workspace accounts. Any active account belonging to a former employee is a gap in the process worth fixing.

---

Conclusion

Consistent, documented user lifecycle management is a security requirement, not just an operational nicety. In Google Workspace, the Admin console gives IT admins the tools to handle onboarding and offboarding systematically, but it takes a written process and consistent execution to make it work.

Grant access through groups, automate provisioning from your directory, suspend before you delete, and decide your data-retention approach in advance. Test the runbook on voluntary departures, so when an urgent, sensitive termination happens, the process is second nature.

---

Official Google documentation:

• Maintain data security after an employee leaves
• Options to preserve former employee data
• Delete or remove a user from your organization
• Suspend a user temporarily
• Secondary calendars will now follow the lifecycle of their owner

Related reading:

• Google Workspace Organizational Units: Admin Guide: OU assignment is the first step in every onboarding.
• Google Workspace Shared Drives: Setup and Permissions: shared drives prevent the file-ownership problems that make offboarding difficult.
• Google Workspace Admin Security: 10-Point Hardening Guide: session management and access revocation are covered in depth.