Google Workspace offboarding: suspending the account is only the first step

Suspending a leaver’s Google Workspace account stops them signing in, but:

• Google keeps billing you for the license
• everyone they shared files with keeps access
• it doesn’t do anything to manage their data

Offboarding is only finished once that data has been preserved or handed over, and the license and account removed without losing anything along the way.

How to offboard a Google Workspace user without losing data or paying for empty accounts

For a typical employee, you’d usually:

• 1. Suspend the account. The leaver can no longer sign in, but their data stays intact while you decide what to do with it. If they own Looker Studio data sources that run on their credentials, switch those to another owner first.
• 2. Close off the remaining access. Reset the password, sign the user out of active sessions, revoke OAuth tokens, app passwords, 2-Step Verification and recovery options, and remove company data from their phone and ChromeOS devices.
• 3. Decide where to send their data. The manager may need the mailbox, but the project team may need the Shared Drives, and finance may need the Looker Studio reports.
• 4. Archive what you need to keep. Do this before you revoke any licenses or delete anything – Google Workspace only has a 20-day restoration window.
• 5. Transfer ownership. Move files, calendars and reports to the people chosen in step 3.
• 6. Set an auto-reply. Direct senders to a new contact, and only grant delegated access to the mailbox where there’s a genuine business need.
• 7. Remove the license, then delete the account. Follow your retention policy, unless you need to keep the account on an Archived User license.
• 8. Review what’s left a few weeks later. Check what the leaver’s former files are still shared with, and whether they’re the only manager on any Shared Drives.

A suspended account costs the same as an active one, and Google won’t move it onto a cheaper license for you

Suspension is the best thing to do first, because it locks the leaver out without deleting anything. But if you only suspend the account, there are financial and security risks.

Google says suspended accounts are “charged at the same rate as active accounts“, on both Flexible and Annual plans.

After the 2025 price rise, which bundled Gemini into every Business plan, Business Standard lists at $14 per user per month on an annual plan and Business Plus at $22.

Each leaver that you only suspend therefore costs between $168 and $264 a year.

Google doesn’t move suspended users onto a cheaper license automatically, although its Vault documentation recommends assigning an Archived User license “instead of, or shortly after, suspending”.

Suspension locks the leaver out, but it doesn’t change their sharing settings and can break some files

Google says that collaborators “will retain their ability to view, edit, and collaborate” on documents the suspended user shared with them. That includes clients, freelancers and anyone else outside the organization, as well as anyone holding an “anyone with the link” URL. Transferring the files to a new owner doesn’t change this either.

New email and calendar invitations to a suspended user are blocked, and meetings they organized stay on colleagues’ calendars.

And some work stops straight away. Looker Studio data sources that use the owner’s credentials (rather than each viewer’s) break as soon as the owner is suspended, so any reports built on them stop loading for everyone who relies on it.

The usual fix here is to switch those data sources to another owner’s credentials before the account is suspended.

Google’s documentation doesn’t say what happens to other things that run under a user’s account, such as scheduled scripts, so check with the leaver’s team to find out which files depend on the user you’re offboarding before you suspend their Workspace account.

Identity providers and Google’s new SCIM support automate the suspension, but they don’t manage the user’s data

Many organizations now deprovision Google Workspace users through an identity provider such as Okta or Microsoft Entra, so the leaver loses access as soon as HR marks them as leaving.

But neither tool deals with the leaver’s data. Okta’s Google Workspace integration suspends the user by default, with options to remove licenses or admin roles.

Microsoft’s documentation states that removing a user from the sync scope “disables them in GSuite but won’t result in deletion“.

Neither Okta nor Entra transfers files, email or calendars.

On July 9, 2026, Google made inbound SCIM (the standard protocol HR systems and identity providers use to create and remove accounts) generally available on Business and Enterprise editions.

More systems will now be able to switch users off in Google directly. However, the announcement doesn’t say whether “deactivate” means suspend, archive or delete – and either way, the data still needs handling separately.

There are four ways to deal with a leaver’s account:

The right solution often depends on the role of the leaver: an executive whose data is under legal hold probably belongs on an Archived User license, while a contractor with a handful of files may only need a transfer and a deletion.

But note that when you delete a user, anything you haven’t transferred is deleted with them.

You can restore the account within 20 days, but that doesn’t bring everything back: Google says Vault data held or retained for the user can be purged as soon as the account is deleted, and restoring the account won’t recover it.

Data missed in a transfer can’t always be recovered by restoring the account. In one July 2026 forum thread, an admin deleted a user and transferred their Drive files, but missed the separate Looker Studio option. They restored the account, and Gmail and Drive came back, but three reports didn’t. Workspace support called the problem “outside their scope“.

Transferring files to a manager hands over ownership, but not control of who can see them

Google’s transfer tool has several limits:

• transferring a file doesn’t change who has access to it, so a link the leaver shared with a client is inherited along with the file
• files in folders the new owner can’t see arrive as shortcuts in a transfer folder, rather than in their original structure
• the recipient must be an active user in the same organization
• files in the Trash aren’t included
• a transfer stops after 36 hours
• only future, non-private events on the primary calendar with a guest or room booked are transferred, and recurring meetings the leaver organized can keep blocking rooms unless they’re released

Sending everything to the manager is the simplest default, and the most common, but the manager isn’t always the person who needs the Shared Drive or the monthly sales report (and sometimes the manager is leaving too).

We think it’s better to decide this resource by resource, at the point someone leaves, than to rely on a single default.

European regulators say forwarding a leaver’s email is generally not compliant

Most offboarding checklists recommend forwarding a leaver’s email to their manager, but European data protection regulators (if you need to be concerned about them) disagree.

Malta’s regulator says automatic forwarding of a former employee’s email is “generally not compliant, even to an address within the same organisation“, and recommends an auto-reply of around a month directing senders to a new contact.

Belgium’s regulator has taken a similar position, and fined one organization €15,000 in a case involving a former employee’s mailbox.

The UK’s ICO hasn’t published equivalent guidance on mailboxes, though it does expect employers to keep a documented retention schedule for employee records.

This isn’t legal advice, and the right approach depends on where you operate. But for UK and European organizations, an auto-reply, time-limited delegated access where there’s a genuine need, and archiving or deleting the mailbox on a set schedule is often far easier to justify than indefinite forwarding.

Schedule a review a few weeks later to catch the external shares and orphaned Shared Drives the offboarded colleague left behind

Even a well-run offboarding leaves things behind: files now owned by someone who didn’t create them, links shared outside the organization, and Shared Drives whose only manager has gone.

When Metomic scanned around 6.5 million Google Drive files in 2023, it found that 34.2% were shared outside the organization, and more than 350,000 were public.

Metomic sells Drive security software and didn’t disclose how many organizations were scanned, so the figures are best treated as directional. But they match what admins describe: people share files individually rather than through Groups or Shared Drives.

Offboarding also has limits as a security measure. In January 2026, former Google engineer Linwei Ding was convicted of stealing more than 2,000 pages of AI trade secrets, much of it moved to a personal cloud account months before he resigned.

Revoking access on someone’s last day protects against what they might do next, but if there’s already been a security breach that’s slipped through the net, it doesn’t protect you. Sharing needs ongoing oversight as well as a check when someone leaves.

A few weeks after someone leaves, it’s worth checking:

• which of their former files are still shared externally or publicly
• whether any Shared Drives now have no manager
• whether anyone who inherited their data has since left
• whether every offboarding step actually completed

Offboarding at scale is complicated by the variety of leavers and their responsibilities

Manual offboarding works for a handful of leavers a year, but becomes hard to do consistently once leavers are a weekly occurrence, because different roles and responsibilities need different approaches.

One of CloudM’s UK retail customers handles around 1,000 offboardings a month, and uses automated workflows to apply the same process across every department.

Leavers under a legal hold can’t have their data transferred or their account deleted

Google doesn’t allow you to transfer data from, or delete, a user who is on litigation hold, and a hold on the leaver also blocks you from transferring their calendar events.

In practice, these accounts usually stay on an Archived User license, so their data remains searchable in Vault, until the legal team releases the hold. Only then can the rest of the process (transfer, license removal, deletion) go ahead.

Senior leavers have more delegated access, and more people depending on their data

An executive’s mailbox and calendar are often shared with an assistant through delegated access, and their files tend to underpin ongoing work with clients, partners and the board.

That usually means an approval step before anything moves, more care over who receives which resources, and a longer retention period than a typical employee.

Layoffs and involuntary leavers need access removed at the right moment, without cutting colleagues off from their work

When someone is let go, access is usually removed as they’re told, or before. Done crudely, that can cause problems for everyone else.

Google’s own January 2023 layoffs are a well-reported example: US staff were locked out overnight, colleagues found out who had gone when their emails bounced back, and some leavers lost personal documents and photos stored in their accounts.

Larger layoff rounds add a practical problem too. Google will only transfer files to an active user, so if a leaver’s manager is leaving in the same round, their files need a different recipient.

Contractors and freelancers often sit outside HR systems, so nothing triggers their offboarding

If a contractor’s Google Workspace account was created outside the HR system, there’s no HR record to change, so an identity provider triggered by HR will never suspend them.

Contractors are also more likely to own files shared with external clients, and any third-party tools they signed into with their Google account keep the accounts they created there, which need removing separately.

Leavers with admin rights or sole ownership of shared resources need replacing before they go

If the leaver is a Google Workspace admin, their admin privileges need removing as part of the lockout, and any scripts or integrations running under their account need a new owner.

The same applies to Shared Drives where they’re the only manager, Google Groups they own, and the Looker Studio data sources covered above. None of these are handled by suspension, and some might stop working when the owner leaves.

Returning employees are much easier to bring back if their data was archived rather than deleted

Rehires are common, especially in sectors with seasonal or high staff turnover.

If the old account was deleted more than 20 days ago, their data is gone. If it’s on an Archived User license, unarchiving it only works if a matching license is free.

But data archived to your own storage can be restored into a new account whenever it’s needed.

CloudM Automate & Protect handles the Google Workspace data that identity providers often leave behind

CloudM Automate & Protect takes over once the account is suspended, handling the data, ownership, license and clean-up steps in Google Workspace. It isn’t a SaaS-wide identity tool, so deprovisioning apps like Slack, GitHub or Salesforce stays with your identity provider.

• Automate & Protect can trigger an offboarding workflow when Google registers a suspension, whichever system made it. That’s how it works alongside Okta without a direct integration.
• With CloudM, automated offboarding workflows can stop so someone can confirm or change who receives each type of resource, from documents and Shared Drives to calendars, Looker Studio reports and email.
• It archives to storage you own. Archive keeps leavers’ Gmail, Drive and Chat data in your own Google Cloud Storage bucket, searchable and restorable down to individual items. You can remove licenses without losing records, and restore someone’s data if they return.
• Automate & Protect also shows what’s been left behind. Drive Management shows external members, public links and Shared Drives without a manager across the domain, which turns the follow-up review into a filter rather than a project. Our guide to managing Google Drive at scale covers this in more detail.
• Each action is logged as succeeded, skipped or failed, and logs can be exported for audit.

If license costs are the main concern, read how Archived User license costs add up before your next renewal, or compare Automate & Protect plans, which differ mainly in how many separate workflows you can create.