13 Steps to Safely Deprovision and Delete a Google Apps User


Published on

13 steps to consider when deleting a Google Apps user in order to minimize the risk of data loss.

Published in: Technology, News & Politics
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

13 Steps to Safely Deprovision and Delete a Google Apps User

  2. 2. 13 STEPS TO SAFELY DEPROVISION AND DELETE A GOOGLE APPS USERBackupify, Inc. 2INTRODUCTIONWhen the time comes to remove a user from a Google Apps domain,administrators are faced with two apparently mutually exclusive goals: Delete the user account to recover the $50 annual seat license fee Preserve all the data in the user account in the event its still neededGoogle Apps domain administrators can square that circle with these simple de-provisioning steps.1. Change the Departing Users PasswordChanging the departing users password accomplishes two goals. First, it locks theuser out of the account, preventing any post-departure access (malicious orotherwise). Second, it allows you, the admin, to log into that account to performany changes or data transfers not possible from the Google Apps AdministratorControl Panel. You can change the users password from the Users & OrganizationTab in your Control Panel. After selecting a new password, be sure to clickthe Reset Sign-In Cookies link to end any logged-in sessions the departing usermay still be running.2. Download a Snapshot of the User Account for SafekeepingDownloading the complete contents of a user account to an offline file is a bestpractice before altering or deleting the account. This preserves the account as itwas before the de-provisioning process, maintaining records-retention complianceand ensuring no vital data is lost. To download a Snapshot of a complete GoogleApps user account, go to www.snapshottool.comand follow the instructions.3. Identify an Account “Executor”Someone at your organization is going inherit the departing users responsibilities,and thus their data — at least in the short run. Identify that employee, as he orshe will become the Executor of the data in the departed account, transferring orresponding to it as needed. (In many cases, the Domain Administrator and the
  3. 3. 13 STEPS TO SAFELY DEPROVISION AND DELETE A GOOGLE APPS USERBackupify, Inc. 3Executor are one in the same, so you may be giving all these permissions toyourself.)4. Set Up the Departing Users Vacation Auto-ResponderLog into the departing users account with the new password, then set up thevacation auto-responder to inform correspondents that the user is no longer withyour organization, and to identify to whom they should direct all future inquiries.(Likely this will be the aforementioned Executor.) Be sure to enable the auto-responder for recipients both inside and outside your domain. The messageshould be similar to the following:“As of Jan. 1, 2012, John Doe is no longer with Acme Incorporated. Please directall future business correspondence to Jane Q. Public, who will handle Mr. Doesaccounts. You can reach Ms. Public at jqpublic@acmeinc.com.”5. Delegate Access to the Departing Users E-mailThe account Executor will need access to any pending correspondence in thedeparting users mailbox, especially if the departure was sudden or occurred onless than friendly terms. Fortunately, you can designate access to a Google Appsmail account to anyone else on your domain. The delegate — who, again, willlikely be the Executor — wont be able to change account permissions, passwordsor chat on the original users behalf, but the delegate can send and receive mailfrom the account until it is suspended or deleted. To delegate mail access, log intoGmail as the departed user and follow the delegation instructions in the MailSettings menu.6. Transfer Ownership of the Departing Users Google DocsWhen the account that owns a Google Doc is deleted, that document is deleted aswell — even if it was shared with other domain users. Put more simply, deleting auser deletes every critical document that user ever created. Fortunately, the GoogleApps Administrator Control Panel offers a method to bulk-transfer ownership of alla users Docs to another domain users account. In other words, you can make theExecutor the owner of all a departing users Docs in a matter of seconds, ensuring
  4. 4. 13 STEPS TO SAFELY DEPROVISION AND DELETE A GOOGLE APPS USERBackupify, Inc. 4that this data stays online and accessible even after the original owner is de-provisioned. The Executor can then transfer individual document ownership on acase-by-case basis.7. Add the Departing Users Contacts to the Google Apps DirectoryIf you have enabled contact sharing to create a common Google Apps Directory ofbusiness-oriented contacts for your domain, you may want to add at least some ofthe departing users Contacts to the Directory. If the departing user was theexclusive point of reference for a key customer or partner, you may want to makethat external contacts address available to everyone. There is no nativefunctionality for adding external contacts to the Directory, but the free version ofSherpaTools allows administrators to import contacts in bulk to the Directory, andfor individual users to share contacts with the Directory.8. Delegate Access to the Departing Users CalendarsIf the departing user managed a shared calendar, or simply had a series ofcompany appointments that the Executor must now manage, it is important totransfer control of those calendars. Simply log in as the departing user, and thenfollow the Share With Specific Users instructions to give the Executor the EditEvents And Manage Sharing access level for the appropriate calendars. TheExecutor can then dole out calendar permissions as needed.9. Transfer Ownership of the Departing Users GroupsFrom the Google Apps Administrator Control Panel, navigate to the Users &Organization Tab, select the departing users account, and then scroll downto Groups to see a list of all groups of which the departing user is a member.Then click the Edit Group Membership link. Add the Executor as a member to eachof these groups and, if the departing user is the Owner of the group, elevate theExecutor to Owner status. The Executor can then later assign Ownership to theappropriate employee(s).10. Audit the Departing Users Non-Core Google Apps Services
  5. 5. 13 STEPS TO SAFELY DEPROVISION AND DELETE A GOOGLE APPS USERBackupify, Inc. 5While Google Apps domains directly control a users Gmail, Docs, Contacts,Calendars and Sites, a Google Apps domain account can be used to access dozensof non-core Google Apps services, including AdWords, Google Analytics, Blogger,Feedburner, Google Voice and YouTube. When you finally delete the departinguser, his or her non-core accounts will also be deleted — along with all thecontent in those accounts. You dont want your websites Feedburner RSS feed orGoogle Analytics account to disappear when you delete the departing user.Most of these non-core services have straightforward methods for transferringownership of, or access to, an account. Virtually all of them enable adequate dataexport via Googles Data Liberation Front. Log into every non-core Google serviceyour organization uses with the departing users credentials, then assess whetherkey data needs to be transferred before you delete the departing user.You should perform the same steps for any Google Apps Marketplace productsinstalled on your domain to ensure no critical functionality or data is lost whenyou remove the departing users account. All the Marketplace Apps installed onyour domain are listed in the Google Apps Administrator Control Panel.11. Set a Calendar Reminder for Yourself to Delete the Departing User in 90DaysWhile youre probably anxious to delete an account and immediately recover the$50 annual seat license fee, its a smart idea to keep the account around for a fewmonths just to make sure that A) the departing employee isnt reinstated, B) nocritical data is placed out of easy access while your organization adjusts to thedeparture and C) your non-core services audit was accurate and complete.12. Delete the Departing Users AccountYes, finally.13. Create a Group with the Same Mail Address as the Deleted UserJust because you deleted a departing user doesnt mean people outside yourorganization will stop sending him or her important emails. While your domains
  6. 6. 13 STEPS TO SAFELY DEPROVISION AND DELETE A GOOGLE APPS USERBackupify, Inc. 6catch-all email address can handle these misdirected emails, you may not want thecatch-all recipient to be the only person dealing with the departed userscorrespondence. Instead, set up a Group with the same email address as the oneformerly used by the deleted user, and then add the Executor and any otherrelevant recipients to the Group. This will ensure that anyone who didnt receivethe auto-responder has his or her mails routed to the appropriate recipient.Follow these steps and you can remove a Google Apps user from your domainwith minimal risk to your data and your business.ABOUT BACKUPIFYBackupify is the leading provider of backup and restore solutions for SaaSapplications including Google Apps, Salesforce, Facebook, Twitter, and more.Backupify was founded in 2008 and is based in Cambridge, MA. Backupify has over200,000 users trusting us with more than 500 million documents, two billion emailmessages and 350 terabytes of data.WHY BACKUP CLOUD DATA?Your data is one of the most critical assets of your business. Like any importantasset, it should be insured. While most SaaS providers, including Google andSalesforce, offer state-of-the-art disaster recovery capabilities that protect youfrom some forms of data loss, you are still at risk for data loss due to user error,hacked accounts and third-party application bugs. To fully replicate your on-premise backup capabilities in the cloud, you need the ability to perform granularrestores, and to retain the control that comes from having your own securesecond copy of the data in your SaaS applications.FIND OUT MOREIf youre interested in the peace of mind you get from an automated Google Appsor Salesforce backup solution, feel free to contact us directly atinfo@backupify.com. Web http://www.backupify.com Phone 1.800.571.4984 Twitter http://twitter.com/backupify
  7. 7. 13 STEPS TO SAFELY DEPROVISION AND DELETE A GOOGLE APPS USERBackupify, Inc. 7Backupify logo is a registered trademark or registered trademarks of Backupify, Inc. All other namesmay be the trademarks or registered trademarks of their respective owners.© 2012 Backupify, Inc. Item: GAT-WP-EN-200110608