21 Leaver offboarding runbook

draft

Google's checklists close with 'prevent unauthorized access after an employee leaves'; this runbook is that item as a fixed sequence rather than a good intention. On HR's notice the account is suspended, live sessions and tokens are killed, recovery paths are stripped, managed devices are wiped (20 Basic mobile device management), data moves to its successors under the retention rules (32 Vault retention & legal hold), and the account register (5 Account inventory (incl. shared/service accounts)) records the outcome. Every step is a GAM one-liner, so the sequence takes minutes once written down — and is reproducible at 6pm on a Friday, which is when it is needed.

Documentation: Maintain data security after an employee leaves

Caveats

Suspension is one click to reverse for any admin — the monthly HR diff is what catches a quiet re-enable, and the exported audit log (№33) is where the re-enable event lands.
Public links owned by the leaver outlive the account if it is deleted before ownership transfer — №11’s sweep is the backstop, but transfer-then-delete is the rule.
Deprovisioning revokes Google-side access only — sessions in third-party SaaS federated through Google Workspace survive it, so offboard the IdP/SaaS side too (№22 is what makes that one place).

Setup steps

Suspend the account the moment HR confirms the departure — suspension stops every new sign-in at once while keeping mail, files and memberships intact for transfer.
open ↗

https://admin.google.com/ac/users · captured 2026-07-15
```
gam update user <leaver> suspended on
```
Suspend, don't delete: deletion starts a 20-day clock after which the data is unrecoverable, strands the leaver's files, and is the LAST step of this runbook, not the first.

Delete or remove a user from your organization
Kill what is already alive: reset sign-in cookies, revoke OAuth tokens, app passwords and backup codes, and rotate the password — suspension alone does not end every existing session or standing credential.
```
gam user <leaver> signout && gam user <leaver> deprovision && gam update user <leaver> password random
```
Strip the recovery paths — a recovery phone that leaves in the leaver's pocket is a password reset waiting to happen.
```
gam update user <leaver> recoveryemail "" recoveryphone ""
```
Wipe the work account from their managed devices (20 Basic mobile device management) — mail already synced to a phone does not care that the password changed.
```
gam print mobile query "email:<leaver>"  →  gam update mobile <resourceId> action account_wipe
```
Transfer what the organization keeps: Drive and Calendar to the manager via a data transfer, group ownerships to a named successor, and any mail the team still needs via delegation or routing — inside what the retention rules (32 Vault retention & legal hold) already require.
```
gam create datatransfer <leaver> gdrive <manager> calendar <manager>
```
Options to preserve former employee data
Remove standing privilege the register knows about: admin role assignments, rows in the delegation and OAuth registers, and every shared-account password the leaver knew — those rotate now.
```
gam print admins | grep <leaver>  →  gam delete admin <assignment>; rotate shared-account credentials from the account register
```
Close out: once transfers are complete and retention allows, archive the account (Archived User license) or delete it, and record the completed runbook against the register entry.
```
gam update user <leaver> archived on  — or, after data transfer completes: gam delete user <leaver>
```
Archive former employee accounts

Ongoing maintenance

automatable: script Monthly: diff suspended accounts against the HR leaver list — every leaver suspended-or-archived, every suspension traceable to a leaver or an incident.
automatable: AI agent After each departure: re-run this control's verify block against the leaver's account before closing the register entry.

How to verify

Attempt a sign-in as the leaver — the response must be 'account disabled', not a password prompt.

Enumerate what survives: tokens, app passwords and backup codes must all come back empty.

gam user <leaver> show tokens
gam user <leaver> show asps
gam user <leaver> show backupcodes

Confirm the devices came back clean: every device row for the leaver shows the account wiped or the device no longer syncing.
```
gam print mobile query "email:<leaver>"
```

draft v0.1.0 Prevent policy #29 · #10 ↗