Become an Offboarding Pro
This article is designed to help you keep important data and protect sensitive data when someone leaves your company. Our aim is to help you avoid a potential G Suite Offboarding nightmare by sharing best practices we’ve learned over the years.
No matter which company, big or small Onboarding and Offboarding are up there with the most essential internal processes. Onboarding (a topic for a future post) is all about employee experience. They are the priority. Their first day/week needs to be smooth, enjoyable and hassle free. When an employee leaves, the priority is the company. And the process starts as soon as they hand over the keys and move on to their next chapter.
The exact Offboarding list will change based on which edition of G Suite you’re using (Basic, Business or Enterprise). For those on Business or Enterprise, using the new Archived User SKU does most of the work for you.
Why use the Archived User SKU vs. simply Suspending a user?
- Suspending a user requires you continue to pay the full license price while the Archived User SKU comes at a fraction of the price.
- While archiving a user typically results in that user no longer receiving emails, calendar invites or files, so the sender is likely to get a bounce back, our process includes a solution to this!
So let’s break this down into 4 important steps, which includes some insight into our Offboarding list. This is tracked in a Google Sheet and is shared with Managers for easy status updates.
1. Who, What and When?
It’s always best to know when someone is leaving as early as possible. Not just to have time to organise the farewell party but also to get it in the diary so you’re prepared to close down all the systems as soon as they are no longer an employee.
Of course in some instances it could be last minute termination and someone might leave today! That’s why having this process in hand is a stress saver!
The ‘Who’ isn’t just the person leaving. It’s also the people involved in the process. This could be: HR, engineers, Office Manager, IT and line managers, but this depends on your company. and they’ll all have different tasks in the process so it’s good to clarify who does what.
We use a simple Google Form so the right information goes to the right people (the same is done for Onboarding).
2. Stop Access!
You want to do this without disrupting any other workflows. Ideally after the employee has left. As you’ll see in our process below ‘Change Password’ is top of the list.
If you leave this to happen too long after they’ve left, then there’s more chance of confidential data getting into the wrong hands.
At the same time we need to respect the confidentiality of the person leaving as you would expect them to respect the private data of the company. So we would only ever use their accounts for finding company related information.
G Suite Basic G Suite Business or Enterprise
Change password | Change password |
Document primary email in notes | Rename account: DepartingAccount-xxx@domain.com |
Document aliases in notes | Reset login cookies |
Rename account: DepartingAccount-xxx@domain.com | Review and revoke app specific passwords |
Reset login cookies | Remove authorized access apps/services |
Review and revoke app specific passwords |
|
Remove authorized access apps/services |
|
Remove recovery email address. |
|
Remove recovery phone number. |
3. Back Up and Document everything
There are many steps in this process and some interfere with others. It’s alive and mistakes can be made. Before you know it you’re one click away from losing a ton of data. So Backing up gives you peace of mind and means that you can go right back to the beginning, where the employee hasn’t yet left and start again! Phew!
G Suite Basic G Suite Business or Enterprise
Restore emails and files from the last 25 days | |
Hide contact from directory | |
Create a group named 'Former Employee - First Last’ | Create a group named 'Former Employee - First Last’ |
Set group email address to ‘DepartingGroup-xxx@emailmeter.com’ | Set group email address to ‘DepartingGroup-xxx@emailmeter.com’ |
Set group description to 'Former Employee - First Last |
Set group description to 'Former Employee - First Last |
Add account executor as group owner |
Add account executor as group owner |
Add original email address and all aliases from the account to the group |
Add original email address and all aliases from the account to the group |
Check group aliases have been added correctly |
Check group aliases have been added correctly |
Set group Settings -> Moderation -> Spam messages: Skip the moderation queue and post to the group |
Set group Settings -> Moderation -> Spam messages: Skip the moderation queue and post to the group |
Set group Permissions -> Basic permissions -> Join the group: Only invited users |
Set group Permissions -> Basic permissions -> Join the group: Only invited users |
Set group Permissions -> Posting permissions -> Attach files: Anyone on the web |
Set group Permissions -> Posting permissions -> Attach files: Anyone on the web |
Set group Permissions -> Posting permissions -> Post: Anyone on the web |
Set group Permissions -> Posting permissions -> Post: Anyone on the web |
Create Shared Drive 'Departed - First Last (primary email)' |
|
Add departing employee to Shared Drive ‘Departed - First Last (primary email)’ as member |
|
Create Vault/MBOX and Vault/PST folders inside Shared Drive |
|
Review and document Gmail forwarding addresses if any and delete those that are not deemed appropriate |
|
Investigate Gmail filters: there might be rudimentary integrations not possible to replicate with a group | |
Export Gmail filters to shared drive 'Departed - First Last (primary email)’ | |
Create user search and save in Offboardings matter | |
Generate Vault MBOX archives with all mails: Vault EMPLOYEE_NAME MBOX (write errors in notes) |
|
Generate Vault PST archives with all mails: Vault EMPLOYEE_NAME PST (write errors in notes) |
|
Generate full Takeout archive (wait for restore to complete) |
|
Document groups former employee belongs to in tab groups |
|
Add account executor to all groups with the same role as former employee |
|
Remove former employee from all groups |
|
Document sites this user has created |
|
Add manager as owner of sites former employee is the sole owner/admin |
|
Document in notes the calendars created by this user |
|
Transfer events and release resources from his main calendar to someone else |
|
Share calendars former employee is the sole owner to executor with "Make changes and manage sharing" |
|
Check which Google services have been used |
|
Move Vault archives to ‘Shared Drive Departed - First Last (primary email)/Vault’ folder |
|
Move Takeout archives from his drive to Shared Drive ‘Departed - First Last (primary email)/Takeout’ folder |
|
Transfer file ownership to admin (wait for Takeout to complete) and move to Shared Drive |
|
Transfer any Shared Drive folder ownership to new owner (wait for Takeout to finish) if only owner |
|
Suspend account |
4. Archive or Delete
So here we have the final step! There’s no going back after this. But it’s best not to do it until you are sure everything is backed up and you know where it all lives.
G Suite Basic G Suite Business or Enterprise
Set calendar reminder in 30 days to delete user. Link to this sheet in notes |
G Suite Business - Archived User orG Suite Enterprise - Archived User depending on your G Suite tier |
Archive or Delete account |