Blog · Employee offboarding · Problem 56 of 93
Someone left and their Google account still works. Close it today, then fix the process.
· 3 min read · By Case Jones
You are the CTO or the person who runs Google Workspace, and you just noticed that someone who left weeks ago can still sign in. Maybe their name showed up on a shared doc, or the license bill caught your eye.
What it costs to leave it
An open account means company email, Drive files and customer data are still reachable by someone outside the company. Anything they can sign into with Google, from your CRM to your cloud console, may still work. In an audit, a leaver with access past their last day is exactly the kind of thing auditors sample for.
What to do in the next hour, and after
Close access first, keep the data second, and then find out how it slipped. These steps use the Google Admin console.
- 1
Suspend the account and end every session
In the Admin console, open the user and suspend them. Then reset the password and sign them out of all sessions, which ends logins on browsers and phones. If you manage devices, wipe company data from their phone.
- 2
Revoke the side doors
Remove any app passwords and third-party apps they connected with OAuth. Check for mail forwarding rules and delegated mailbox access set up before they left. Remove them from groups, especially ones that grant access to other systems.
- 3
Check everything they signed into with Google
Suspending the Google account stops new Sign in with Google logins, but existing sessions in other apps can stay open. Go through the apps that use Google sign-in and remove the person in each one. Do the same for any app with its own password.
- 4
Keep the data before you delete
Transfer their Drive files and anything else you need to their manager before deleting the account. Deleted users can be restored for only a short time, so do the transfer first. A suspended account usually still uses a paid license, so finish the cleanup instead of leaving it suspended for months.
- 5
Find out why it slipped and write it down
Usually nobody told IT, or the person who knew the steps was away. Write the offboarding steps as a checklist that starts on the last day, with a named owner for each step. Keep a record of each run, including an export showing the accounts are gone.
Example
A sample offboarding checklist
Last day, HR: confirm end date and notify IT. Last day, IT: suspend Google account, reset password, sign out of sessions, remove app passwords and OAuth apps, remove from groups. Last day, IT: remove from each system on the systems list, and export the user list showing they are gone. Within a week, manager: confirm data transfer. A second person signs off the run.
Or make offboarding a checklist that starts on its own
In 93 Compliance, your offboarding procedure becomes a runnable checklist. It can start from a button or from another system, like your HR system, through an API key or a webhook. Each step goes to a role, HR, IT or the manager, and waits in that team's queue until someone takes it. Overdue steps remind and then escalate.
Controls collect the proof, like a screenshot or an export showing the accounts are gone, and a sign-off that cannot be done by the person who did the work. The systems register lists the systems to check, with owners and MFA, and every run is kept as a record for your auditor.
- Offboarding as a runnable checklist
- Steps routed to HR, IT and the manager
- Evidence of removed accounts at each step
- A sign-off by someone other than the person who did it
- A systems register so nothing gets missed
Make offboarding a checklist
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Should I suspend or delete a former employee's Google account?
Suspend it right away to block access, then transfer the data you need and delete it. Suspending is instant and reversible, which makes it the right first move.
Does suspending a Google account log them out of other apps?
Not always. It stops new Sign in with Google logins, but sessions already open in other apps may keep working until they expire. Remove the person from each app directly.
How do I find every system a leaver had access to?
Keep a list of your systems with an owner for each, and check every one when someone leaves. Your Google Workspace security pages also show which third-party apps the person connected.
How fast should access be removed when someone leaves?
On their last day, and right away for an involuntary departure. Many policies say within 24 hours. Whatever yours says, record the time you did it.