Back to All Cheatsheet Libraries cheatsheets

Google Workspace Admin

Admin console reference, onboarding/offboarding runbooks with a full GAM offboarding script, 100 daily admin tips, and a security baseline.

/ ← domain-wide defaults, deliberately restrictive ├── /Staff │ ├── /Staff/IT ← relaxed: admin tools, Marketplace installs │ └── /Staff/General ├── /Contractors ← tighter: no external sharing, no Takeout ├── /Service-Accounts ← non-human, 2SV exempt, heavily restricted └── /Suspended ← offboarded users parked here, all services off

Showing results

Area	Where	What you do there	Notes
Users	Directory → Users	Create, suspend, rename, reset passwords, move OU, manage aliases.	Bulk-update via CSV upload. Suspend rather than delete — deletion starts a 20-day recovery clock and complicates data transfer.
Users	Directory → Organisational units	The policy hierarchy for users and devices.	A user is in exactly one OU. Settings inherit down and can be overridden per OU.
Users	Directory → Groups	Mailing lists, access control, and Drive/Calendar sharing targets.	Use groups for access, OUs for policy. Groups can be security groups for finer-grained permission assignment.
Users	Directory → Directory settings	Sharing of the global directory, profile editing, custom user fields.	Custom fields (employee ID, manager, start date) are queryable via GAM and useful for automation.
Security	Security → Authentication → 2-Step Verification	Enforce 2SV, set enrollment grace periods, allow/disallow methods.	Enforce for admins first, always. Roll out to users with a grace period and a communications plan.
Security	Security → Access and data control → API controls	Which third-party apps may access Workspace data via OAuth.	Set to trusted apps only. Unrestricted OAuth is how data quietly leaves an organisation.
Security	Security → Access and data control → Context-Aware Access	Conditional access by device state, IP, and location.	Higher editions only. The Workspace analogue of Conditional Access.
Security	Security → Alert centre	Suspicious login, malware, data-loss, and government-attack warnings.	Configure who receives alerts. An unmonitored alert centre is worse than none.
Security	Security → Admin roles	Delegate scoped administrative privileges.	Use pre-built or custom roles. Minimise Super Admins — see the Security tab.
Apps	Apps → Google Workspace → Gmail	Routing, compliance rules, spam/attachment policy, SPF/DKIM/DMARC.	Routing rules are per-OU and evaluated in order — the usual cause of "why did that mail go there".
Apps	Apps → Google Workspace → Drive and Docs	External sharing, shared drive creation rights, link defaults, Takeout.	Sharing policy is per-OU. Contractors typically get a stricter OU than staff.
Apps	Apps → Google Workspace → Calendar	External sharing of free/busy, resource (room) management.	Rooms and equipment are created here under Buildings and resources.
Apps	Apps → Google Workspace Marketplace apps	Allow-list third-party add-ons, install domain-wide.	Pair with API controls. Domain-installed apps skip individual user consent.
Devices	Devices → Mobile & endpoints	Basic or advanced mobile management, approval, and remote wipe.	Account wipe removes only corporate data; device wipe factory-resets. Know which button you're pressing on a BYOD phone.
Devices	Devices → Chrome → Devices / Settings	Chromebook enrollment, policies, kiosk and guest sessions.	Requires a per-device Chrome Upgrade licence — see Workspace for Education.
Reporting	Reporting → Audit and investigation	Login, admin, Drive, Gmail, token, and device logs.	The investigation tool (higher editions) allows bulk remediation directly from search results.
Reporting	Reporting → Reports	Usage, security posture, and app-adoption dashboards.	Useful for spotting unused licences before a renewal.
Billing	Billing → Subscriptions	Licence counts, plan changes, Archived User licences.	Archived User (AU) licences retain a leaver's data at lower cost than a full seat — see the offboarding tab.
Data	Vault (vault.google.com)	Retention rules, legal holds, eDiscovery search and export.	Separate console. A legal hold overrides deletion, including for suspended and deleted users.

Create the account in the correct OU

OU determines every inherited policy, so setting it at creation avoids a second pass. Agree a naming convention early (first.last@ is typical) and stick to it — inconsistency here haunts automation forever.

gam create user first.last@example.com \ firstname First lastname Last \ org "/Staff/General" \ password "$(openssl rand -base64 18)" changepassword on

Add to groups by role, not individually

Group membership should follow the job. Maintain a role→groups mapping so "Sales rep" always produces the same access — this is what makes onboarding auditable.

Assign the licence

Verify the correct SKU. Users without a licence can be created but can't use paid services, which produces confusing "it's broken" tickets on day one.

Enforce 2SV enrollment with a grace period

Set a new-user enrollment window (commonly 1–7 days). Long enough to get a phone set up, short enough that it actually happens.

Populate the directory profile

Manager, department, employee ID, start date. These drive dynamic groups, org charts, and offboarding automation later — fill them in now or you'll be back-filling under pressure.

Provision the device

Chromebook enrollment, or MDM enrollment for Mac/Windows. See MDM Fundamentals for zero-touch paths.

Send credentials out of band

Never email a temporary password to the personal address you also used as the recovery address. Send it via a separate channel (SMS, manager, password manager invite).

Offboarding — order matters more than speed

Suspend the account

Immediately blocks sign-in everywhere. Do this at the agreed termination time, not after the exit interview.

gam update user leaver@example.com suspended on

Kill live sessions and revoke tokens

Suspension blocks new sign-ins but existing session cookies and OAuth tokens can persist. deprovision revokes application-specific passwords, OAuth tokens, backup codes, and un-enrolls security keys in one command.

gam user leaver@example.com signout gam user leaver@example.com deprovision

Reset the password

Belt and braces — ensures no cached credential works even if suspension is later reversed by mistake.

gam update user leaver@example.com password random

Capture group memberships before removing them

Export first. If the departure is disputed or reversed, you'll need to know what they had — and it's the only record of role-based access after the fact.

gam print groups member leaver@example.com > leaver-groups.csv gam user leaver@example.com delete groups

Transfer Drive ownership

Use a data transfer, which moves ownership of files in My Drive to the successor. Shared drive content isn't owned by the user and stays put — that's a good reason to keep team content in shared drives in the first place.

gam create datatransfer leaver@example.com gdrive \ manager@example.com privacy_level shared,private

Handle mail — forward, delegate, or autoreply

Pick deliberately. Delegation lets the manager read the mailbox without receiving a copy; forwarding pushes new mail onward; an autoresponder tells senders where to go instead. Many organisations do all three for a fixed window.

gam user leaver@example.com add delegate manager@example.com gam user leaver@example.com forward on manager@example.com keep gam user leaver@example.com vacation on \ subject "No longer with the company" \ message "Please contact team@example.com." contactsonly off

Transfer calendar ownership

Recurring meetings the leaver organised will otherwise become unmanageable. Transfer events and any resources they own.

gam create datatransfer leaver@example.com calendar \ manager@example.com release_resources true

Wipe or unenroll devices

Account wipe for BYOD (removes only corporate data). Device wipe only for company-owned hardware. Getting this wrong on a personal phone is a serious incident.

Move to the Suspended OU and strip the alias

Parking suspended users in their own OU with all services disabled prevents accidental reactivation with full access. Remove aliases so the address can be reused or bounce cleanly.

gam update user leaver@example.com org "/Suspended"

Switch to an Archived User licence

An AU licence retains the account's data for Vault search at a fraction of a full seat's cost. This is the correct answer to "we might need their mail later" — far better than paying for a full licence indefinitely.

Apply retention or legal hold, then delete on schedule

If there's any litigation risk, place a Vault hold before deletion — a hold preserves data even against deletion. Otherwise delete at the end of your documented retention window. Deletion is recoverable for 20 days, then permanent.

A complete offboarding script

#!/usr/bin/env bash # offboard.sh — Google Workspace offboarding # Usage: ./offboard.sh leaver@example.com manager@example.com [--live] # # Defaults to DRY RUN. Pass --live to actually execute. # Order is deliberate: cut access first, preserve data second, # destructive cleanup last. set -euo pipefail LEAVER="${1:?usage: offboard.sh [--live]}" MANAGER="${2:?manager address required}" LIVE="${3:-}" STAMP="$(date +%Y%m%d-%H%M%S)" LOGDIR="./offboard-${LEAVER%%@*}-${STAMP}" SUSPENDED_OU="/Suspended" mkdir -p "$LOGDIR" run() { if [ "$LIVE" = "--live" ]; then echo "+ gam $*" | tee -a "$LOGDIR/actions.log" gam "$@" else echo "[DRY RUN] gam $*" | tee -a "$LOGDIR/actions.log" fi } echo "=== Offboarding $LEAVER -> $MANAGER ===" [ "$LIVE" = "--live" ] || echo "*** DRY RUN — pass --live to execute ***" # 0. Snapshot BEFORE changing anything. This is the only record of what # the account had, and you cannot reconstruct it afterwards. echo "--- capturing pre-change state ---" gam info user "$LEAVER" > "$LOGDIR/user-info.txt" 2>&1 || true gam print groups member "$LEAVER" > "$LOGDIR/groups.csv" 2>&1 || true gam user "$LEAVER" print filelist > "$LOGDIR/drive-files.csv" 2>&1 || true gam user "$LEAVER" show delegates > "$LOGDIR/delegates.txt" 2>&1 || true gam user "$LEAVER" show forwards > "$LOGDIR/forwards.txt" 2>&1 || true # 1. CUT ACCESS — instant and reversible. echo "--- 1. revoking access ---" run update user "$LEAVER" suspended on run user "$LEAVER" signout run user "$LEAVER" deprovision # tokens, app passwords, backup codes, keys run update user "$LEAVER" password random # 2. PRESERVE DATA — must happen before any deletion. echo "--- 2. transferring data ---" run create datatransfer "$LEAVER" gdrive "$MANAGER" privacy_level shared,private run create datatransfer "$LEAVER" calendar "$MANAGER" release_resources true # 3. MAIL CONTINUITY — delegate + forward + autoresponder. echo "--- 3. mail handling ---" run user "$LEAVER" add delegate "$MANAGER" run user "$LEAVER" forward on "$MANAGER" keep run user "$LEAVER" vacation on \ subject "No longer with the company" \ message "This person has left. Please contact ${MANAGER}." \ contactsonly off # 4. STRIP ACCESS SURFACE. echo "--- 4. removing group memberships ---" run user "$LEAVER" delete groups # 5. PARK the account. echo "--- 5. moving to suspended OU ---" run update user "$LEAVER" org "$SUSPENDED_OU" echo echo "=== Complete. Logs: $LOGDIR ===" cat <<NEXT Manual follow-up (deliberately NOT automated): * Wipe/unenroll devices — choose ACCOUNT wipe for BYOD, DEVICE wipe only for company-owned hardware. * Switch to an Archived User licence to cut cost while retaining data. * Apply a Vault retention rule or legal hold if there is any dispute or litigation risk. A hold survives deletion; nothing else does. * Delete the account only after the documented retention window. Deletion is recoverable for 20 days, then permanent. * Reassign or remove any shared drive manager role they held. NEXT

Offboarding mistakes that cost real money

Deleting before transferring Drive. The most common and most expensive error. Suspend, transfer, then delete.
Forgetting shared drive manager roles. A shared drive whose only manager has been deleted becomes unmanageable — audit for sole managers before offboarding.
Device-wiping a personal phone. Account wipe versus device wipe is a one-click difference with a very different outcome.
Leaving the licence assigned. Paying full price for suspended accounts adds up quietly. Archived User licences exist for exactly this.
Not capturing group membership first. Once removed, there's no record of what access they had — which matters if the departure becomes contested.
Missing Vault holds. If legal asks six months later and you deleted on schedule, the data is gone. Check for hold obligations before deleting.

GAM — the tool that makes Workspace administration scalable

The Admin console is fine for one user. GAM (Google Apps Manager) is how you do anything to a hundred of them, script an offboarding, or answer "which accounts haven't logged in for 90 days?" in one line. It's open source, free, and effectively the standard tool for Workspace admins.

Two projects, and people confuse them: GAM7 is the mainline project. GAMADV-XTD3 is an advanced fork with extra commands and different syntax in places. Start with GAM7; move to the fork only if you hit a specific gap.

Installing and authorising

Install

The installer downloads GAM, places it in ~/bin/gam7 (or your chosen path), and starts the setup wizard.

# macOS / Linux bash <(curl -s -S -L https://gam-shortn.appspot.com/gam-install) # Windows — download the EXE installer from GitHub Releases # Or as a Python package, if you manage your own Python pip install gam7

Create a Google Cloud project and authorise

The wizard walks you through it. GAM needs its own Cloud project with the Admin SDK and related APIs enabled — use a dedicated project, not one shared with production workloads.

gam create project gam oauth create # browser sign-in, writes oauth2.txt gam user admin@example.com check serviceaccount

Authorise domain-wide delegation for the service account

Some commands act as a user (reading their Drive, setting their signature). That requires the service account to hold domain-wide delegation scopes, granted in the Admin console under Security → API controls → Domain-wide delegation. check serviceaccount tells you exactly which scopes are missing.

Verify it works

gam version gam info domain gam info user admin@example.com

Protect the credentials — they are super-admin equivalent

oauth2.txt, oauth2service.json, and client_secrets.json in the GAM config directory grant full administrative control of your Workspace tenant. Treat them exactly like a root private key: never commit them, never put them in shared storage, restrict file permissions, and revoke immediately if a machine is lost.

chmod 600 ~/.gam/oauth2.txt ~/.gam/oauth2service.json

Showing results

Area	Task	Command	Notes
Info	Domain overview	`gam info domain`	Verifies auth is working. Always the first command to run on a new setup.
Info	User detail	`gam info user user@example.com`	Add `noaliases` or `nogroups` to trim output.
Info	GAM version	`gam version`	Include this when asking for help — behaviour differs across versions.
Users	Create a user	`gam create user first.last@example.com firstname First lastname Last password "S3cret!" changepassword on`	Add `org "/Path"` to place them in an OU at creation.
Users	Suspend / restore	`gam update user user@example.com suspended on\|off`	Instant and reversible. Always the first offboarding step.
Users	Reset password	`gam update user user@example.com password random changepassword on`	`random` generates and prints a strong password.
Users	Move OU	`gam update user user@example.com org "/Staff/IT"`	Policy changes follow the OU move, sometimes after a short delay.
Users	Add an alias	`gam create alias sales@example.com user user@example.com`	Aliases are free and don't consume a licence.
Users	Deprovision (revoke everything)	`gam user user@example.com deprovision`	Revokes app passwords, OAuth tokens, backup codes, and un-enrolls security keys. Essential in offboarding.
Users	Force sign-out	`gam user user@example.com signout`	Invalidates active session cookies — suspension alone may not drop live sessions instantly.
Users	Delete / undelete	`gam delete user user@example.com` · `gam undelete user user@example.com`	20-day recovery window. After that it's permanent.
Users	Export all users	`gam print users fields primaryemail,name,ou,suspended,lastlogintime > users.csv`	The workhorse reporting command. Pipe into a spreadsheet for audits.
Users	Find dormant accounts	`gam print users query "isSuspended=false" fields primaryemail,lastlogintime`	Sort by last login to find licences worth reclaiming.
Groups	List all groups	`gam print groups`	Add `members managers owners` to include membership counts.
Groups	Group detail	`gam info group team@example.com`	Shows settings and membership.
Groups	Add / remove a member	`gam update group team@example.com add member user@example.com`	Swap `add` for `remove`; roles are `member`, `manager`, `owner`.
Groups	A user's groups	`gam print groups member user@example.com`	Capture this before offboarding — it's the only record afterwards.
Groups	Remove from all groups	`gam user user@example.com delete groups`	Irreversible in one step — export first.
Drive	List a user's files	`gam user user@example.com print filelist`	Large mailboxes take a while. Redirect to CSV.
Drive	Transfer Drive ownership	`gam create datatransfer old@example.com gdrive new@example.com privacy_level shared,private`	Only transfers My Drive. Shared drive content is owned by the drive, not the user.
Drive	Check transfer status	`gam print datatransfers`	Transfers are asynchronous — verify completion before deleting the source account.
Drive	Find externally-shared files	`gam user user@example.com print filelist query "visibility='anyoneWithLink'"`	A genuinely useful security audit across the domain.
Drive	List shared drives	`gam print shareddrives`	Audit for shared drives with only one manager before that person leaves.
Gmail	Add a delegate	`gam user user@example.com add delegate manager@example.com`	Delegate reads the mailbox without receiving copies.
Gmail	Set forwarding	`gam user user@example.com forward on manager@example.com keep`	`keep` retains a copy; alternatives are `archive`, `delete`, `markread`.
Gmail	Set autoresponder	`gam user user@example.com vacation on subject "Away" message "..." contactsonly off`	Set `contactsonly off` so external senders get it too.
Gmail	Set a signature	`gam user user@example.com signature file sig.html html`	Combine with a CSV loop to apply a templated signature domain-wide.
Gmail	Show filters / forwards	`gam user user@example.com show filters`	Check for unauthorised auto-forwarding — a classic sign of account compromise.
Calendar	Transfer calendar events	`gam create datatransfer old@example.com calendar new@example.com release_resources true`	`release_resources` frees any rooms the leaver had booked.
Calendar	Add a calendar ACL	`gam calendar cal@example.com add owner user@example.com`	Roles: `owner`, `writer`, `reader`, `freebusy`.
Devices	List Chrome devices	`gam print cros fields serialnumber,status,lastsync,ou`	Essential for Chromebook fleet audits and AUE planning.
Devices	Move a Chromebook OU	`gam update cros <deviceId> ou "/Devices/Carts"`	Combine with `gam csv` for bulk moves.
Devices	List mobile devices	`gam print mobile`	Use `gam update mobile <id> action account_wipe` for BYOD offboarding.
Reports	Login audit	`gam report login user all`	Add `start 2026-08-01` to bound the range.
Reports	Admin activity audit	`gam report admin`	Who changed what in the Admin console — the first place to look after an unexpected change.
Reports	Drive activity	`gam report drive`	Useful for investigating suspected data exfiltration.
Reports	Licence assignment	`gam print licenses`	Reconcile against active users before a renewal.
Bulk	CSV loop	`gam csv users.csv gam update user ~primaryEmail org "/Staff"`	`~column` substitutes a CSV field. The single most useful GAM pattern.
Bulk	Batch file	`gam batch commands.txt`	One GAM command per line; runs them in sequence.
Bulk	Redirect output to CSV	`gam redirect csv ./out.csv print users`	Cleaner than shell redirection — handles headers correctly.
Bulk	Act on all users	`gam all users show filters`	`all users` and `ou "/Path"` are powerful selectors — and dangerous with a destructive verb.

GAM safety rules

GAM has no undo and no confirmation prompt. gam all users delete ... will do exactly what you asked, immediately.
Test destructive commands on a single throwaway account first. Every time, not just the first time.
Use print to preview what a selector matches before running an action against it.
The credential files are super-admin equivalent. Never commit them, never share them, chmod 600 them.
Run GAM from a controlled admin workstation, not a shared machine.
GAM actions appear in the admin audit log attributed to the authorising account — which is good for accountability and a reason to use a dedicated admin identity.

Showing results

Area	Tip	Why / how
Users	Suspend, don't delete	Suspension is instant and fully reversible. Deletion starts a 20-day clock and complicates data transfer.
Users	Set the OU at creation	Saves a second pass and ensures the user never briefly sits under permissive root-level policy.
Users	Agree a username convention early	Mixed conventions break automation and directory lookups forever. Decide once, document it.
Users	Aliases are free	Up to 30 per user, no licence cost. Use them for role addresses instead of extra accounts.
Users	Bulk-update via CSV	Directory → Users → Bulk update. Handles hundreds of edits without scripting.
Users	Fill in manager and department	Drives org charts, dynamic groups, and offboarding automation. Empty fields cost you later.
Users	Use custom user fields	Employee ID, start date, cost centre — queryable via GAM and useful for reconciliation with HR.
Users	Never reuse an email address quickly	A new person inherits calendar invites, shared file access, and mailing lists aimed at the old one.
Users	Recover a deleted user within 20 days	Directory → Users → Deleted users. After that window it's genuinely unrecoverable.
Users	Send credentials out of band	Never email a temporary password to the same personal address used as the recovery address.
OUs	OUs for policy, groups for access	The single most important structural rule. Conflating them produces unmaintainable permissions.
OUs	Keep the root OU restrictive	Everything inherits from root. Default-deny at the top and relax per child OU.
OUs	Create a Suspended OU	Park offboarded users there with all services disabled — prevents accidental reactivation with full access.
OUs	Separate contractors	Tighter external sharing, no Takeout, restricted Marketplace. Different risk profile, different OU.
OUs	Give service accounts their own OU	Non-human accounts need different 2SV and session policies. Isolating them avoids awkward exceptions.
OUs	Don't nest more than 3–4 deep	Deep hierarchies make inherited-setting debugging painful. Flatter is easier to reason about.
OUs	Test policy on a pilot OU	Move two willing users into a test OU before rolling a setting domain-wide.
OUs	Expect propagation delay	Setting changes can take up to 24 hours, though usually minutes. Don't chase a bug that's just latency.
Groups	Use groups for Drive sharing	Share to a group, not individuals. Access then follows group membership automatically.
Groups	Security groups for permissions	Marking a group as a security group allows finer-grained access control and admin role assignment.
Groups	Lock down who can post externally	Default group settings often allow external posting. Review this on every group that receives mail.
Groups	Audit groups with no owner	Ownerless groups drift. Assign at least two owners to anything business-critical.
Groups	Use collaborative inboxes carefully	Good for shared support queues, but assignment features are basic — a real helpdesk tool may fit better.
Groups	Export membership before bulk changes	GAM There's no undo for a mass membership removal.
Groups	Dynamic groups where available	Membership driven by directory attributes (department, location) maintains itself.
Security	Enforce 2SV on admins first	Non-negotiable. An unprotected super-admin account is the whole tenant.
Security	Keep 2+ super admins, but few	One is a single point of failure; ten is an attack surface. Two or three is usually right.
Security	Use a break-glass admin account	Dedicated, hardware-key protected, not used daily, credentials stored offline.
Security	Admins should have a separate daily account	Don't browse the web and read mail as a super admin. Separate identity for privileged work.
Security	Prefer hardware security keys	The only 2SV factor genuinely resistant to phishing. SMS is the weakest option.
Security	Restrict OAuth app access	Security → API controls → trusted apps only. Unrestricted OAuth is a quiet data-exfiltration path.
Security	Review third-party app access quarterly	Apps accumulate. Check what has Drive or Gmail scopes and revoke what's unused.
Security	Watch for unauthorised mail forwarding	GAM Auto-forward rules to external addresses are a classic compromise indicator.
Security	Disable less-secure app access	Legacy protocols bypass 2SV. Turn them off unless a specific system genuinely requires them.
Security	Configure the Alert Centre recipients	Alerts nobody receives are worthless. Route them to a monitored address or ticket queue.
Security	Turn on Google's advanced phishing protections	Gmail settings include extra spoofing and attachment protections that aren't all on by default.
Security	Enrol high-risk users in Advanced Protection	Executives and finance staff. Enforces security keys and restricts app access aggressively.
Security	Set session length for admins	Shorter re-auth windows on privileged accounts limit the value of a stolen session.
Security	Use Context-Aware Access if licensed	Gate access by device posture, IP, or geography — Workspace's conditional access equivalent.
Security	Check the security health page	Security → Security centre → Health surfaces misconfigurations against Google's recommendations.
Security	Delegate admin roles, don't hand out super admin	Help desk staff need user-management rights, not the whole tenant. Custom roles are granular.
Gmail	Set up SPF, DKIM, and DMARC	All three. Without them your domain is trivially spoofable and your mail lands in spam.
Gmail	Start DMARC at p=none	Collect reports first, fix legitimate senders, then move to quarantine and reject. Jumping straight to reject breaks mail.
Gmail	Routing rules are ordered	They evaluate top-down per OU. Unexpected delivery is almost always rule ordering.
Gmail	Use the Email Log Search	Reporting → Email log search traces exactly what happened to a specific message. First stop for "they never got it".
Gmail	Set attachment compliance rules	Block executables and password-protected archives inbound rather than relying on user judgement.
Gmail	Add an external-sender banner	A visible warning on external mail is one of the cheapest anti-phishing controls available.
Gmail	Configure a catch-all carefully — or not at all	Catch-alls attract spam and hide typos that should bounce. Usually better left off.
Gmail	Use delegation instead of shared passwords	Never share mailbox credentials. Delegation gives access with attribution and is revocable.
Gmail	Deploy signatures centrally	GAM A templated signature applied via CSV loop beats asking 200 people to update theirs.
Gmail	Understand the 25 MB attachment limit	Larger files auto-convert to Drive links — and recipients need permission to that file.
Gmail	Know the sending limits	Roughly 2,000 external recipients per day for Workspace accounts. Bulk mail belongs in a real platform.
Drive	Shared drives for team content, always	Files in My Drive leave with the person. Shared drive content is owned by the team and survives departures.
Drive	Audit shared drives with a single manager	If that person leaves, the drive becomes unmanageable. Require two managers minimum.
Drive	Set external sharing per OU	Staff and contractors rarely need the same sharing rights.
Drive	Default link sharing to restricted	"Anyone with the link" as a default is how documents end up indexed publicly.
Drive	Audit publicly-shared files	GAM Query for `anyoneWithLink` visibility across the domain periodically.
Drive	Use target audiences	Changes the default sharing suggestion from "anyone" to a defined internal audience.
Drive	Control Takeout per OU	Users exporting their entire Drive on their last day is a real data-loss vector. Disable for contractors.
Drive	Storage is pooled, not per-user	On most editions. One user hoarding video affects everyone's headroom.
Drive	Google-format files don't count toward quota	Docs/Sheets/Slides created in Drive are free; uploaded Office files and media are not.
Drive	Version history works on uploads too	Right-click → Manage versions on a PDF or ZIP, not just Google formats.
Devices	Know account wipe vs device wipe	Account wipe removes corporate data only. Device wipe factory-resets. Never confuse them on BYOD.
Devices	Require device approval	Prevents unknown devices syncing corporate mail the moment someone adds the account.
Devices	Basic management is free and better than nothing	Even without advanced management you get inventory and remote account wipe.
Devices	Chromebook enrollment is sticky	Powerwash doesn't un-enroll a managed Chromebook — it returns to the enrollment screen still bound to your domain.
Devices	Enroll Chromebooks before first sign-in	If a user signs in first you must Powerwash and start over. `Ctrl+Alt+E` at the sign-in screen.
Devices	Track Chromebook AUE dates	After Auto Update Expiration there are no more security updates. Plan refresh around it.
Devices	Workspace device management isn't full MDM	Fine for account protection; not a substitute for Intune/Jamf on managed laptops.
Audit	Admin audit log first, always	When a setting changed unexpectedly, this tells you who and when.
Audit	Login audit reveals impossible travel	Two sign-ins from distant countries minutes apart is a compromise indicator.
Audit	Drive audit for exfiltration investigations	Shows mass downloads and sharing changes — the standard leaver investigation.
Audit	Token audit shows OAuth grants	What third-party apps a user authorised, and with what scopes.
Audit	Logs have a retention limit	Export what you need for long-term compliance rather than assuming it stays forever.
Audit	Set up custom alerts	Alert on admin privilege grants and suspicious login patterns rather than reviewing logs manually.
Audit	Export logs to BigQuery	Higher editions can stream audit data to BigQuery for real long-term analysis.
Vault	Retention rules and holds are different things	Retention deletes on schedule; a hold preserves indefinitely and overrides deletion.
Vault	A hold survives account deletion	This is exactly why you place holds before offboarding anyone with litigation risk.
Vault	Default retention deletes data permanently	Setting an aggressive org-wide retention rule will destroy data on schedule. Model it before enabling.
Vault	Vault access is separately privileged	Being a super admin doesn't grant Vault rights by default — and shouldn't.
Vault	Archived User licences retain data cheaply	Keeps a leaver's data Vault-searchable without paying for a full seat.
Licensing	Audit licences before renewal	GAM Suspended-but-licensed accounts are pure waste. Reconcile against active users.
Licensing	Use automatic licensing carefully	Convenient, but it silently assigns paid seats to every new account including test ones.
Licensing	Groups don't need licences	A shared address doesn't have to be a user account. Use a group and save the seat.
Licensing	Editions differ substantially	Vault, Context-Aware Access, and DLP are edition-gated. Check before promising a feature.
Troubleshoot	Check the Workspace Status Dashboard first	Before deep-diving a "Gmail is broken" ticket, confirm it isn't a Google-side incident.
Troubleshoot	Reproduce in an incognito window	Rules out extensions and multi-account sign-in, which cause a surprising share of reported faults.
Troubleshoot	Multi-account sign-in causes chaos	Personal and work accounts in one browser profile produce permission errors that look like bugs.
Troubleshoot	Confirm which OU the user is in	"Works for me, not them" is usually a per-OU policy difference.
Troubleshoot	Allow for propagation delay	Changes can take up to 24 hours. Don't stack three more changes while waiting.
Troubleshoot	Use Email Log Search for delivery issues	Definitive answer on whether a message arrived, was rejected, or was filtered.
Troubleshoot	Check the Alert Centre during incidents	Often already tells you what happened before anyone raises a ticket.
Troubleshoot	Contact support with a case ID early	Paid editions include support. Open the case while investigating rather than after exhausting yourself.
GAM	Preview with print before acting	See exactly what a selector matches before running a destructive verb against it.
GAM	Master `gam csv`	The single highest-leverage GAM pattern — bulk anything from a spreadsheet.
GAM	Treat oauth2.txt as a root key	It grants full tenant control. Never commit, never share, `chmod 600`.
GAM	GAM has no undo	No confirmation prompt either. Test on a throwaway account every time.
GAM	Script offboarding, don't freestyle it	A reviewed script does the steps in the right order every time, under time pressure.
GAM	Redirect output to CSV	`gam redirect csv ./out.csv print users` handles headers correctly.
GAM	Keep GAM updated	Google's APIs change. An old GAM fails in confusing ways against new behaviour.
Process	Document the leaver policy	How long data is retained and who deletes it. Without this, accounts accumulate indefinitely.
Process	Reconcile with HR monthly	Active accounts for people who left months ago is both a cost and a security problem.
Process	Keep a change log	The audit log tells you what changed; your notes tell you why. Future you needs both.
Process	Test settings on yourself first	Put your own account in the pilot OU. You'll notice breakage faster than a ticket will surface it.
Process	Subscribe to the Workspace release notes	Google ships changes continuously. Reading these prevents being surprised by your own tenant.
Process	Never test in production on a Friday	Propagation delays mean you may not see the damage until Monday, with nobody around.

Protect the admin accounts

Enforce 2SV on all admins, ideally hardware security keys. Phishing-resistant factors are the only ones that stop a determined attacker.
Keep two or three super admins, no more. Every additional one is another full-tenant compromise path.
Maintain a break-glass account: dedicated, hardware-key protected, not used day to day, credentials stored offline and tested periodically.
Admins should have a separate everyday account. Don't read mail and browse the web as a super admin.
Delegate scoped admin roles for help desk work instead of handing out super admin.

Close the OAuth and legacy-protocol gaps

Security → API controls → restrict to trusted apps only. Unrestricted third-party OAuth access is a quiet, fully-authorised data-exfiltration path that bypasses everything else.
Review connected apps quarterly and revoke anything unused or unrecognised.
Disable less-secure app access and legacy IMAP/POP where possible — these bypass 2SV entirely.
Watch for OAuth grants with broad Gmail or Drive scopes appearing suddenly across multiple users. That pattern is a phishing campaign, not coincidence.

Authenticate your outbound mail

SPF, DKIM, and DMARC — all three. Without them your domain can be spoofed trivially and your legitimate mail lands in spam.
Start DMARC at p=none with reporting, identify every legitimate sender, then escalate to quarantine and finally reject.
Going straight to p=reject will break mail from systems you'd forgotten send as your domain — invoicing, marketing, monitoring.
Add an external-sender banner. Cheap, and it measurably reduces successful phishing.

Control data leaving the organisation

Set Drive external sharing per OU — contractors and staff rarely warrant the same rights.
Default link sharing to restricted, not "anyone with the link".
Audit for publicly-shared files periodically. It's a one-line GAM query and it always finds something.
Consider disabling Takeout for OUs that have no legitimate need — mass self-export on someone's last day is a real pattern.
Use DLP rules (higher editions) to flag or block sharing of content matching sensitive patterns.

Monitor and be able to investigate

Route Alert Centre notifications to a monitored address or ticket queue. Alerts nobody reads provide assurance without safety.
Know the four logs that matter: admin (who changed what), login (impossible travel, failed attempts), Drive (mass download or sharing changes), and token (OAuth grants).
Set custom alerts on high-signal events — admin privilege grants especially.
Understand your log retention limit and export beyond it if you have compliance obligations.

Responding to a compromised account

Suspend and terminate sessions

Suspension blocks new sign-ins, but existing session cookies and OAuth tokens can survive it. Do all three.

gam update user victim@example.com suspended on gam user victim@example.com signout gam user victim@example.com deprovision

Check for persistence mechanisms

Attackers establish persistence so regaining access survives a password reset. The common ones, in order of frequency:

gam user victim@example.com show filters # auto-forward / auto-delete rules gam user victim@example.com show forwards # mailbox forwarding gam user victim@example.com show delegates # added delegate access gam user victim@example.com show tokens # rogue OAuth grants

Auto-forwarding rules and added delegates are the classic ones. A rule that forwards then deletes matching mail is designed to hide invoice-fraud replies from the real owner.

Determine the blast radius

Login audit for source IPs and times. Drive audit for mass downloads or sharing changes. Admin audit if the account held any privileges. Check whether the same OAuth grant appears on other users — phishing campaigns rarely target one person.

Recover deliberately

New password, re-enroll 2SV from scratch (assume backup codes are compromised), remove every rogue filter/forward/delegate found in step 2, then restore access. Verify with the user that the mailbox looks right.

Close the path that was used

If it was phishing, the fix is 2SV enforcement and better factors, not just a lecture. If it was OAuth, restrict app access. An incident that doesn't change a control will recur.

Organisational Units are the decision you can't easily undo

Onboarding — get it repeatable, then automate it

Create the account in the correct OU

Add to groups by role, not individually

Assign the licence

Enforce 2SV enrollment with a grace period

Populate the directory profile

Provision the device

Send credentials out of band

Offboarding — order matters more than speed

Two rules that prevent most offboarding disasters

Suspend the account

Kill live sessions and revoke tokens

Reset the password

Capture group memberships before removing them

Transfer Drive ownership

Handle mail — forward, delegate, or autoreply

Transfer calendar ownership

Wipe or unenroll devices

Move to the Suspended OU and strip the alias

Switch to an Archived User licence

Apply retention or legal hold, then delete on schedule

A complete offboarding script

Read before running

GAM — the tool that makes Workspace administration scalable

Installing and authorising

Install

Create a Google Cloud project and authorise

Authorise domain-wide delegation for the service account

Verify it works

Protect the credentials — they are super-admin equivalent

100 things a Workspace admin actually does

A security baseline worth implementing in order

Responding to a compromised account

Contain first, investigate second

Suspend and terminate sessions

Check for persistence mechanisms

Determine the blast radius

Recover deliberately

Close the path that was used

GAM and automation

Official documentation

Related cheatsheets