Tool
Offboarding checklist generator
Enter the leaver and the receiving manager to generate an ordered offboarding checklist with a timing against each step. Order matters more than completeness: revoking tokens before transferring ownership stops a leaver re-authorising a sync client mid-handover.
- 1Reset Leaver name's password and sign out all sessionsHour 0
- 2Revoke OAuth tokens, app passwords and connected devicesHour 0
- 3Remove from admin roles and privileged groupsHour 0
- 4Set a mail delegate or forward to Manager nameHour 0–1
- 5Transfer Drive ownership of files owned by the userDay 0–1
- 6Transfer calendar ownership of recurring meetings and roomsDay 1
- 7Reassign shared drive manager rights held only by the leaverDay 1
- 8Remove from groups, aliases and on-call rotationsDay 1
- 9Confirm Vault retention or hold covers the account before any deletionDay 1
- 10Convert to an Archived User licence rather than deletingDay 2
- 11Record completion, who did it, and the date in the leaver logDay 2
Order matters: revoking tokens before transferring ownership prevents a leaver re-authorising a sync client mid-handover.
The step most often skipped is reassigning shared drive manager rights held only by the leaver. Nobody notices until months later, when a shared drive has no manager and no one can restore a deleted folder or add a new member.
Record who completed the process and when. A dated leaver log is the evidence an auditor asks for, and it is the difference between a control that exists and one you can prove.
What this doesn't cover
- Non-Google systems and SaaS accounts need their own leaver steps, not covered here.
- Legal hold decisions belong to your counsel, not to an admin console workflow.
- Hardware return, badge access and payroll are outside the Workspace tenant.
Questions we get asked
- How do I offboard a Google Workspace user properly?
- Reset the password and revoke tokens first, then transfer Drive and calendar ownership, remove group memberships, confirm Vault retention, and finally archive or delete the account.
- Should I delete a leaver's account?
- Not immediately. An Archived User licence keeps the data searchable in Vault at a fraction of a full seat, which matters if a dispute or investigation surfaces months later.
Related pages
Want joiners and leavers handled for you?
A managed retainer covers the full user lifecycle with a documented, logged process in your own console, so nothing depends on someone remembering the order.