What should you do on the employee's last day?
On the last day, cut off access before you do anything else. Plan the timing with whoever handles HR, so access ends when employment ends and not days later.
- Reset the user's password in the Admin console.
- Sign the user out of all active sessions, using the option on their user page in the Admin console.
- Remove company data from their phones and tablets using mobile management.
- Revoke app passwords and any third-party app access connected to their account.
- Remove security keys or other 2-Step Verification devices that belong to the employee.
Suspending the account also blocks sign-in while keeping data in place. It is a useful pause while you finish the steps below, but a suspended user in most cases still counts as a paid license. For how offboarding fits with your other controls, see our Google Workspace security and HIPAA guide.
How do you keep their files and email?
You keep files by transferring ownership, and you keep email by delegating, routing, or archiving the mailbox.
For files, use the data transfer tool in the Admin console to move the user's My Drive files and calendars to a manager or colleague. Files the user created in shared drives already belong to the team and stay where they are, which is one reason to store team work there. Our guide to My Drive vs shared drives explains the difference.
For email, choose what fits the role:
- Delegate the mailbox to a manager for a short period, so they can answer clients.
- Set an auto-reply that points senders to a new contact.
- After the account is gone, add the old address as an alias on another user or route it to a Google Group, so mail keeps arriving.
If you need a record of the mailbox, export it before you delete the account.
Should you suspend, archive, or delete the account?
You should suspend for a short pause, archive when you need to keep data long term, and delete when you do not need the data at all.
| Option | What it does | License |
|---|---|---|
| Suspend | Blocks sign-in, keeps all data | Usually still billed |
| Archived User license | Keeps data available, including to Vault | Lower cost than a full license, in editions that offer it |
| Delete | Removes the account and its data after any transfer | Frees the license |
Deleting an account also ends Vault preservation for that user's data, even under a hold. Read Google Vault retention and eDiscovery basics before you delete anyone whose data may be needed later. Administrators can restore a deleted user only for a short period. If you handle regulated records, confirm your retention obligations with your compliance officer or counsel.
What else should you update?
You should update every place the user had access beyond their own account.
- Remove them from Google Groups, and transfer ownership of any group they managed.
- Check shared drives where they were the only manager, and add another manager.
- Review apps that use Google sign-in, plus any apps with separate passwords.
- Reclaim the license, or reassign it to a new hire. See right-sizing your Google Workspace licenses.
- Record what you did and when, which helps with audits.
Write these steps into a checklist with named owners, and use the same order every time. Add it to your Google Workspace security checklist.
Next step
If you want help building an offboarding process that fits your edition and retention needs, see our HIPAA setup service or contact us.
Frequently asked questions
Can we read a former employee's email?
Administrators can delegate the mailbox to another user, and editions with Vault can search and export it. Whether you should depends on your written policies, employment agreements, and local law, so set a clear policy and check it with counsel.
Should we forward a former employee's mail to their personal address?
No. Forwarding business mail to a personal account sends company and client data outside your control. Route it to a manager, a shared Google Group, or an alias on a current account instead, and set an auto-reply with the new contact.
