13 Steps to Safely Deprovision and Delete a Google Apps User

THIRTEEN STEPS TO SAFELY
DEPROVISION AND DELETE
A GOOGLE APPS USER
BACKUPIFY – JUNE 2012

13 STEPS TO SAFELY DEPROVISION AND DELETE A GOOGLE APPS USER
Backupify, Inc. 2
INTRODUCTION
When the time comes to remove a user from a Google Apps domain,
administrators are faced with two apparently mutually exclusive goals:
 Delete the user account to recover the $50 annual seat license fee
 Preserve all the data in the user account in the event it's still needed
Google Apps domain administrators can square that circle with these simple de-
provisioning steps.
1. Change the Departing User's Password
Changing the departing user's password accomplishes two goals. First, it locks the
user out of the account, preventing any post-departure access (malicious or
otherwise). Second, it allows you, the admin, to log into that account to perform
any changes or data transfers not possible from the Google Apps Administrator
Control Panel. You can change the user's password from the Users & Organization
Tab in your Control Panel. After selecting a new password, be sure to click
the Reset Sign-In Cookies link to end any logged-in sessions the departing user
may still be running.
2. Download a Snapshot of the User Account for Safekeeping
Downloading the complete contents of a user account to an offline file is a best
practice before altering or deleting the account. This preserves the account as it
was before the de-provisioning process, maintaining records-retention compliance
and ensuring no vital data is lost. To download a Snapshot of a complete Google
Apps user account, go to www.snapshottool.comand follow the instructions.
3. Identify an Account “Executor”
Someone at your organization is going inherit the departing user's responsibilities,
and thus their data — at least in the short run. Identify that employee, as he or
she will become the Executor of the data in the departed account, transferring or
responding to it as needed. (In many cases, the Domain Administrator and the

Backupify, Inc. 3
Executor are one in the same, so you may be giving all these permissions to
yourself.)
4. Set Up the Departing User's Vacation Auto-Responder
Log into the departing user's account with the new password, then set up the
vacation auto-responder to inform correspondents that the user is no longer with
your organization, and to identify to whom they should direct all future inquiries.
(Likely this will be the aforementioned Executor.) Be sure to enable the auto-
responder for recipients both inside and outside your domain. The message
should be similar to the following:
“As of Jan. 1, 2012, John Doe is no longer with Acme Incorporated. Please direct
all future business correspondence to Jane Q. Public, who will handle Mr. Doe's
accounts. You can reach Ms. Public at jqpublic@acmeinc.com.”
5. Delegate Access to the Departing User's E-mail
The account Executor will need access to any pending correspondence in the
departing user's mailbox, especially if the departure was sudden or occurred on
less than friendly terms. Fortunately, you can designate access to a Google Apps
mail account to anyone else on your domain. The delegate — who, again, will
likely be the Executor — won't be able to change account permissions, passwords
or chat on the original user's behalf, but the delegate can send and receive mail
from the account until it is suspended or deleted. To delegate mail access, log into
Gmail as the departed user and follow the delegation instructions in the Mail
Settings menu.
6. Transfer Ownership of the Departing User's Google Docs
When the account that owns a Google Doc is deleted, that document is deleted as
well — even if it was shared with other domain users. Put more simply, deleting a
user deletes every critical document that user ever created. Fortunately, the Google
Apps Administrator Control Panel offers a method to bulk-transfer ownership of all
a user's Docs to another domain user's account. In other words, you can make the
Executor the owner of all a departing user's Docs in a matter of seconds, ensuring

Backupify, Inc. 4
that this data stays online and accessible even after the original owner is de-
provisioned. The Executor can then transfer individual document ownership on a
case-by-case basis.
7. Add the Departing User's Contacts to the Google Apps Directory
If you have enabled contact sharing to create a common Google Apps Directory of
business-oriented contacts for your domain, you may want to add at least some of
the departing user's Contacts to the Directory. If the departing user was the
exclusive point of reference for a key customer or partner, you may want to make
that external contact's address available to everyone. There is no native
functionality for adding external contacts to the Directory, but the free version of
SherpaTools allows administrators to import contacts in bulk to the Directory, and
for individual users to share contacts with the Directory.
8. Delegate Access to the Departing User's Calendars
If the departing user managed a shared calendar, or simply had a series of
company appointments that the Executor must now manage, it is important to
transfer control of those calendars. Simply log in as the departing user, and then
follow the Share With Specific Users instructions to give the Executor the Edit
Events And Manage Sharing access level for the appropriate calendars. The
Executor can then dole out calendar permissions as needed.
9. Transfer Ownership of the Departing User's Groups
From the Google Apps Administrator Control Panel, navigate to the Users &
Organization Tab, select the departing user's account, and then scroll down
to Groups to see a list of all groups of which the departing user is a member.
Then click the Edit Group Membership link. Add the Executor as a member to each
of these groups and, if the departing user is the Owner of the group, elevate the
Executor to Owner status. The Executor can then later assign Ownership to the
appropriate employee(s).
10. Audit the Departing User's Non-Core Google Apps Services

Backupify, Inc. 5
While Google Apps domains directly control a user's Gmail, Docs, Contacts,
Calendars and Sites, a Google Apps domain account can be used to access dozens
of non-core Google Apps services, including AdWords, Google Analytics, Blogger,
Feedburner, Google Voice and YouTube. When you finally delete the departing
user, his or her non-core accounts will also be deleted — along with all the
content in those accounts. You don't want your website's Feedburner RSS feed or
Google Analytics account to disappear when you delete the departing user.
Most of these non-core services have straightforward methods for transferring
ownership of, or access to, an account. Virtually all of them enable adequate data
export via Google's Data Liberation Front. Log into every non-core Google service
your organization uses with the departing user's credentials, then assess whether
key data needs to be transferred before you delete the departing user.
You should perform the same steps for any Google Apps Marketplace products
installed on your domain to ensure no critical functionality or data is lost when
you remove the departing user's account. All the Marketplace Apps installed on
your domain are listed in the Google Apps Administrator Control Panel.
11. Set a Calendar Reminder for Yourself to Delete the Departing User in 90
Days
While you're probably anxious to delete an account and immediately recover the
$50 annual seat license fee, it's a smart idea to keep the account around for a few
months just to make sure that A) the departing employee isn't reinstated, B) no
critical data is placed out of easy access while your organization adjusts to the
departure and C) your non-core services audit was accurate and complete.
12. Delete the Departing User's Account
Yes, finally.
13. Create a Group with the Same Mail Address as the Deleted User
Just because you deleted a departing user doesn't mean people outside your
organization will stop sending him or her important emails. While your domain's

Backupify, Inc. 6
catch-all email address can handle these misdirected emails, you may not want the
catch-all recipient to be the only person dealing with the departed user's
correspondence. Instead, set up a Group with the same email address as the one
formerly used by the deleted user, and then add the Executor and any other
relevant recipients to the Group. This will ensure that anyone who didn't receive
the auto-responder has his or her mails routed to the appropriate recipient.
Follow these steps and you can remove a Google Apps user from your domain
with minimal risk to your data and your business.
ABOUT BACKUPIFY
Backupify is the leading provider of backup and restore solutions for SaaS
applications including Google Apps, Salesforce, Facebook, Twitter, and more.
Backupify was founded in 2008 and is based in Cambridge, MA. Backupify has over
200,000 users trusting us with more than 500 million documents, two billion email
messages and 350 terabytes of data.
WHY BACKUP CLOUD DATA?
Your data is one of the most critical assets of your business. Like any important
asset, it should be insured. While most SaaS providers, including Google and
Salesforce, offer state-of-the-art disaster recovery capabilities that protect you
from some forms of data loss, you are still at risk for data loss due to user error,
hacked accounts and third-party application bugs. To fully replicate your on-
premise backup capabilities in the cloud, you need the ability to perform granular
restores, and to retain the control that comes from having your own secure
second copy of the data in your SaaS applications.
FIND OUT MORE
If you're interested in the peace of mind you get from an automated Google Apps
or Salesforce backup solution, feel free to contact us directly at
info@backupify.com.
 Web http://www.backupify.com
 Phone 1.800.571.4984
 Twitter http://twitter.com/backupify

Backupify, Inc. 7
Backupify logo is a registered trademark or registered trademarks of Backupify, Inc. All other names
may be the trademarks or registered trademarks of their respective owners.
© 2012 Backupify, Inc. Item: GAT-WP-EN-200110608

13 Steps to Safely Deprovision and Delete a Google Apps User

More Related Content

Viewers also liked (20)

Similar to 13 Steps to Safely Deprovision and Delete a Google Apps User (20)

More from Datto (20)

Recently uploaded (20)

13 Steps to Safely Deprovision and Delete a Google Apps User