25 Mar 9 Steps To Correctly Deprovisioning A User In Google Apps

In the vast majority of cases, no one likes it when someone has to leave an organisation. While others in the organisation might reminisce about good times in the past, IT administrators need to take a few steps to ensure their account is properly deprovisioned.

In fact, for a lot of IT administrators, the deprovisioning process occurs all too frequently. If you want to make sure that you’re correctly deprovisioning a user in Google Apps and not missing a single step, follow the 9 steps we’ve laid out below. The workflow below outlines BetterCloud’s recommended best practices for properly deprovisioning users, ensuring that no stone is left unturned.

1) HIDE THE USER FROM THE DIRECTORY

If a user has left the organisation, you might as well go ahead and hide their user profile from the directory. This will keep other users from continuing to see the user’s information in type-ahead and auto-complete areas.

While the user is still active at this point, their account will no longer be visible to other users in the directory or the type-ahead menus in Gmail and Google Drive.

2) RESET THEIR PASSWORD

As soon as the user no longer needs access to their account, reset the Google Apps password so that they can no longer log in to the account.

To reset sign-in cookies, find the user in the Google Apps Admin Console, and click the “Reset sign-in cookies” link to log the user out of any current sessions. Without this step, users can stay logged into active sessions (such as a home computer).

3) SET UP AN AUTOREPLY

Autoreplies let email senders know immediately that they are contacting someone who is no longer with your organisation. To set up an autoreply, you’ll actually need to log into the user’s account, create the message, and activate it.

4) DELEGATE THEIR INBOX

We recommend delegating the inbox, instead of forwarding mail, although you can do that too. Typically it’s sufficient for the responsible party to log in to the delegated mailbox once a week and check for any relevant mail, which in turn helps keep their inbox less cluttered than it would be if the terminated user’s mail were being forwarded.

5) TRANSFER OWNED ASSETS

Transferring owned assets (Google Docs, Sites and Calendars) is the biggest fundamental difference in deprovisioning a user from Google Apps as compared to other systems such as Microsoft Exchange. In many ways, transferring owned assets is much easier than backing up files onto a hard drive, but there’s also a risk that you permanently delete assets owned by the departing user during the process.

If you delete a user in Google Apps without transferring their assets to a new owner, ALL of these assets will be permanently deleted (with the exception of Sites).

6) TRANSFER GROUP OWNERSHIP & MEMBERSHIP

While you don’t run the risk of deleting Google Groups if you do not transfer ownership (like you do with assets), it’s still a good idea to transfer ownership to another user when you’re deprovisioning a user.

7) SUSPEND THE USER

After completing the prior tasks, you can now suspend the departing user. Suspending a user disables the account without deleting the user profile and their related information, such as documents, calendar events, and email. A user cannot sign in to a suspended account, and new information, such as emails and calendar invitations, are blocked.

Suspending the user is an important step of the deprovisioning process. If you aren’t ready to do this yet, set a reminder for yourself.

8) ARCHIVE THE USER’S MAILBOX

If you plan on deleting the user, it’s a good idea to retain a copy of their inbox in case you need to access it later. All of their email will be deleted when you go to delete the user.

9) DELETE THE USER (OPTIONAL)

If you’re confident that you have downloaded or transferred all of the necessary data from the user’s account, it’s safe to go ahead and delete the user so that you can reuse the Google Apps license.

If you can avoid it though, it’s best to leave the user suspended for as long as possible, just in case something comes up. You can rename these users to “pending.delete” to remind you of what is ok to delete when you need to free up a license.

CONCLUSION

While this may seem like a lot of steps to take, we truly believe it is the best way to ensure an account has been properly deprovisioned. Since the process can be tedious, we’ve compiled the BetterCloud Deprovisioning Workflow which is conveniently integrated inside of BetterCloud.

In addition to the Deprovisioning Workflow, BetterCloud for Google Apps provides critical insights, automated management, and intelligent data security for the Google for Work platform, all integrated within a comprehensive and web-based interface. By leveraging open APIs, BetterCloud securely connects with your data at its source, providing maximum control without requiring any cumbersome setup.

To learn more about deprovisioning users in Google Apps, as well as onboarding new users, download BetterCloud’s Guide To User Onboarding And Deprovisioning In Google Apps for free.

For more information about using BetterCloud’s deprovisioning workflow, or implementing BetterCloud onto your Google Apps for Work domain, visit the AppsCare webpage or contact a member of the AppsCare team on +44 (0) 113 366 2008 or email helpmegogoogle@appscare.com.

You can also join the Hangout on Air on April 30th, 15:00 for a full product demonstration and more information about BetterCloud. Sign up here.