Google Workspace managed services

Every retainer begins with an authorisation matrix: who may request what, which changes we make on request, which need a second approver, and which we will refuse without a written instruction from a director. Suspending an account, changing a payment-related group, or altering DMARC policy sit in the second and third categories.

This exists because the most damaging thing an outsourced administrator can do is act quickly on a plausible instruction. A named requester list with a callback rule on privileged changes costs nothing and removes an attack path that has been used against managed providers repeatedly.

Joiner and leaver processing dominates. Each joiner involves account creation, group membership, licence assignment, device enrolment and a welcome sequence; each leaver involves suspension, data transfer, licence reclamation and a dated evidence record. Organisations under a hundred seats routinely underestimate this by a factor of three.

The remainder splits between security alert triage, DNS and third-party sender changes, shared drive permission untangling, and the quarterly reviews. Genuine outages are rare, and when they occur they are usually Google's rather than ours, which makes status communication the useful skill rather than repair.

The quarterly licence review compares assigned seats against thirty-day activity, lists suspended accounts still consuming licences, and identifies users on an edition they demonstrably do not use. In a typical first review this returns between six and twelve per cent of annual licence spend.

We report the saving as a written list you action rather than executing downgrades unilaterally, because edition changes affect Vault retention and Context-Aware Access eligibility. Presenting the list keeps the decision with the person who owns the consequences.

Thirty days' notice, no exit fee, and a documented handover: admin credentials returned, our delegated accounts deleted with a dated confirmation, the change log and authorisation matrix handed over as files you keep, and a call with the incoming provider if you want one.

Providers who make leaving difficult are relying on friction rather than performance. Publishing the exit terms alongside the service terms is the cheapest possible demonstration that the retainer is meant to be renewed on merit.