Need this done now? In the Google Admin console, go to Directory, then Users, select the person, and click Suspend user. Suspension instantly blocks their access to Gmail, Drive, and every Workspace service while keeping all their data intact. Do that first, then transfer their files and revoke app and device access before deleting the account.
When someone is let go, the clock starts immediately. A departing employee with live access to Google Drive can copy client files, delete shared documents, or forward email long after they have left the building. The good news: locking them out takes about thirty seconds if you know which button to press. This guide gives you the immediate action first, then the full, calm offboarding so nothing is lost and no door is left open.
You will need administrator access to the Google Admin console. If you are not a Workspace admin, get the person who is on the phone now and walk them through the first step.
Do This First (Right Now)
Before anything else, suspend the account. Suspending is not the same as deleting. It cuts off all access in one move but keeps every file, email, and setting in place so you can deal with the data without pressure.
- Sign in to the Google Admin console at admin.google.com with an administrator account.
- Go to Directory, then Users.
- Find the departing employee and click their name.
- Click Suspend user, then confirm.
That is it for the emergency. The moment you confirm, the person is signed out everywhere and cannot get back into Gmail, Drive, Calendar, or any Workspace app. Their data is untouched and waiting for you. Now you can do the rest properly instead of in a panic.
The Full Offboarding Steps
With access cut, work through these in order. The goal is to recover their work, hand it to the right person, and close every path back in before you remove the account.
1. Reset sign-in cookies
Suspension blocks new sign-ins, but an already-open session can linger. On the user's page, under Security, choose Reset sign-in cookies. This forces every active session to log out immediately, including mobile apps that were already signed in.
2. Transfer their Drive files
Everything in the employee's My Drive belongs to that account. If you delete the account without transferring, those files go with it. Use Apps, Google Workspace, Drive and Docs, Transfer ownership, or the Transfer data option on the user's page, to move their My Drive contents to a manager or teammate. Files already in Shared Drives stay put and do not need transferring.
3. Handle their email
Decide who needs the mailbox. You can transfer it, set up an auto-reply, or forward incoming mail to a manager so client messages do not vanish. Do this while the account is suspended, not deleted.
4. Remove devices and app access
Under the user's Security section, review connected applications and remove their access tokens, and wipe or remove any managed mobile devices. A password reset alone does not revoke third-party apps that were already authorized.
5. Delete the account (after everything is moved)
Once the files, email, and access are handled, you can delete the account to free the license. Because you transferred the data first, nothing is lost. If you are unsure, leave it suspended; a suspended account is fully locked and safe to revisit.
The Side Doors People Miss
Cutting the main account is the big win, but a few quieter paths often stay open after a sloppy offboarding. Check these:
- Externally shared files. Documents the employee shared by link or to an outside email still work after they leave. Audit their shares and reset link access on anything sensitive.
- Personal devices. A phone or home laptop with a live session is closed by resetting sign-in cookies, which is why that step matters.
- Connected third-party apps. Tools they linked to the Workspace account (CRMs, schedulers, automation) can hold standing access tokens. Revoke them.
- Group and calendar ownership. If they owned a Google Group or shared calendar, reassign it so it does not become orphaned.
Why a Password Change Is Not Enough
The instinct after a departure is to change the password. That is not enough, and trusting it creates a false sense of safety. A password change does not end active sessions, does not revoke the third-party apps the employee already connected, and does nothing about files they shared externally or copied. Suspending the account and walking the steps above is what actually closes the door.
The deeper risk is what a single messy departure reveals: usually there was no process, no one was sure who had access to what, and the scramble happened because the environment was never set up to make offboarding clean. That is the gap worth fixing, because the next departure is coming whether you are ready or not.
Prevent the Next Scramble
A clean offboarding takes minutes when the environment is built for it: a documented checklist, clear file ownership, Shared Drives instead of personal My Drives for company work, enforced two-factor authentication, and a known admin process. Most small businesses do not have this until a bad departure forces the issue.
That is exactly what NeuGenity's 70-point Google Workspace Security Assessment is for. It maps who can reach what, finds the over-shared Drives, stale accounts, and missing 2FA that make departures dangerous, and leaves you with a documented offboarding process so the next exit is a checklist, not a fire drill. If you have just been through a difficult departure, a quick call with Christopher is the fastest way to confirm nothing is still exposed.
Frequently Asked Questions
Answered by Christopher Samuels · Google Workspace Certified Administrator · NeuGenity
The fastest single action is to suspend the user in the Google Admin console (Directory, Users, select the person, Suspend user). Suspension instantly blocks sign-in across Gmail, Drive, and every Workspace service, and it preserves all of their data so you can transfer it. Suspend first, then do the rest of the offboarding without time pressure.
Suspend first, do not delete. Deleting an account immediately starts removing its data and can break file ownership and sharing for the rest of your team. Suspend to cut access, transfer the files and email you need, then delete the account later once everything is safely moved.
Use the Admin console transfer tool (the user's page, More, Transfer data, or Apps, Google Workspace, Drive and Docs, Transfer ownership). It moves the contents of My Drive to a manager or teammate so nothing is lost when the account is later deleted. Files in Shared Drives stay in place and do not need transferring.
Suspension stops the person from reaching anything, but files they shared externally still exist. After suspending, audit their external shares and reset any shared links, transfer My Drive ownership, and confirm Shared Drive membership. Resetting their sign-in cookies and revoking connected third-party apps closes the side doors a password change alone misses.
Put a documented offboarding process in place before you need it: suspend, transfer data, revoke app and device access, and reset sharing in a set order. A 70-point Google Workspace Security Assessment from NeuGenity builds that process and finds the access gaps, over-shared Drives, stale accounts, and missing 2FA, that make departures risky in the first place.
Just Had a Difficult Departure?
NeuGenity's 70-point Security Assessment confirms nothing is still exposed after an employee leaves and builds a clean offboarding process so the next departure is simple.