# Employee offboarding checklist for Workspace and Microsoft 365

> Delete a Google account too early and its Gmail goes with it; an unlicensed OneDrive turns read-only at day 60. The steps in order, with a dated plan script.

- Published: 2026-11-06
- Author: 28creation Desk
- Format: Guide
- URL: https://28creation.com/articles/employee-offboarding-workspace-microsoft-365/

## The short read

**Deleting a Google Workspace user deletes their Gmail too, and an admin has only 20 days to undo it.**

- Microsoft says signing a leaver out can take up to an hour and blocking sign-in up to 24 hours, so reset the password first.
- An unlicensed OneDrive turns read-only after 60 days and is archived after 93, though Microsoft's offboarding overview says it stays accessible.

### What you can do with this

> Before anyone leaves, turn on Enable access delegation in the SharePoint admin center and set a secondary owner. Without it, Microsoft says no one gets a deleted user's OneDrive.

---

When someone leaves, the order of the offboarding steps decides what you keep. In Google Workspace, deleting the account deletes that person's Gmail, and you have 20 days to undo it. In Microsoft 365, signing someone out from the admin center can take up to an hour, and a user mailbox left without a license loses its data after 30 days.

If you run IT for a small company on either suite, here is the checklist. It follows the order the vendors' own admin pages imply, with every timing we found in them. We read those pages on November 1, 2026. Then we wrote a short Python script that turns a list of leavers into dated deadlines and a calendar file, and tested it on made-up sample rows.

## The order matters because deletion is the step that loses data

Both vendors build offboarding around one fact: data that sits only in the leaver's account dies with the account. Google's [delete-a-user page](https://knowledge.workspace.google.com/admin/users/delete-or-remove-a-user-from-your-organization) says it bluntly: "A deleted user's data is unrecoverable once it's deleted." Gmail messages and attachments go with the account. Drive files the user owns are kept for 20 days and are reachable only if you restore the user.

Microsoft's [offboarding overview](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee) lists seven steps, and deletion comes last. After you delete the account, email and OneDrive content is kept for 30 days, during which you can restore the user.

So the safe sequence on both platforms is the same: cut access first, hand over mail, files and calendars second, deal with licenses third, and delete last. Our earlier piece on [what each suite can restore after a deletion](/articles/workspace-microsoft-365-restore-windows/) covers the restore windows in detail. This guide is about the steps before them.

## Decide first: delete, keep or suspend

Each path has a different cost and a different clock. Pick one before you touch anything, because some steps only work in one state.

| Path | Google Workspace | Microsoft 365 |
|---|---|---|
| Delete the account | Undo within 20 days; Flexible plan billing is prorated, Annual plan billing does not change | Undo within about 30 days; the license can be reassigned |
| Keep the account, stop paying | Archived User license (sold separately; we found no price on Google's page) | Remove the license; convert the mailbox to shared first, or its data goes after 30 days |
| Suspend or block | Billed at the full rate on both plans | Block sign-in; the license stays paid until you remove it |

The rows come from Google's pages on [suspending](https://knowledge.workspace.google.com/admin/users/suspend-a-user-temporarily), [archiving](https://knowledge.workspace.google.com/admin/users/archive-former-employee-accounts) and [deleting](https://knowledge.workspace.google.com/admin/users/delete-or-remove-a-user-from-your-organization) users, and Microsoft's [license removal](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-6) and [deletion](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-7) steps.

**When not to delete:** in Microsoft 365, never delete an account you use for mail forwarding or a shared mailbox. Microsoft's step 7 says "Both need the account to anchor the forwarding or shared mailbox." In Google Workspace, do not delete a user on litigation hold: Google says you cannot, and a Vault admin must lift the hold first, which "can take up to 48 hours".

## Step 1: Cut access, and know how long it takes

Both vendors pair the password reset with a second action that ends sessions already open on browsers, phones and apps.

**Google Workspace.** Google's [security checklist for leavers](https://knowledge.workspace.google.com/admin/users/maintain-data-security-after-an-employee-leaves) has seven steps. Wipe mobile devices and remove the recovery email and phone. Change the password, revoke OAuth tokens and reset sign-in cookies. Revoke security keys and app passwords, then delete the account.

The cookie reset sits under **Directory > Users**, then the user, then **Security > Sign-in cookies > Reset**, per Google's [sign-out page](https://knowledge.workspace.google.com/admin/devices/sign-a-user-out-of-a-managed-google-account). It signs the user out of browsers and mobile devices. But in Google's words, it "does not sign them out of apps, such as Gmail and Google Drive for desktop." Suspending the user resets the cookies automatically.

Google's [password reset page](https://knowledge.workspace.google.com/admin/users/reset-a-users-password) adds that "all ASPs are revoked" after a reset, meaning app-specific passwords. Scripts can do the same through the Directory API with `POST https://admin.googleapis.com/admin/directory/v1/users/{userKey}/signOut`, which Google's [API reference](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/signOut) says "Signs a user out of all web and device sessions and reset their sign-in cookies."

**Microsoft 365.** Microsoft's [step 1](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-1) goes: **Users > Active users**, select the user, **Reset password**, then on the **Account** tab **Sign out of all sessions**. The user is asked to sign in again "within an hour", because "An access token is good for an hour." For an immediate sign-out, Microsoft points to PowerShell:

```powershell
Revoke-MgUserSignInSession -UserId leaver@example.com
```

The cmdlet's [reference page](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users.actions/revoke-mgusersigninsession) says it invalidates all refresh tokens and browser session cookies for the user. Then **Block sign-in**, with a warning worth reading twice: "Blocking an account can take up to 24 hours to take effect." That is why the reset comes first.

For mail, Microsoft's [step 7](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-7) gives the delays. A session ended in the Exchange admin center or PowerShell has an "Expected delay" of "within 30 min". In the Microsoft Entra admin center it is 60 minutes, and in an on-premises environment "3 hours or more". The Exchange command that ends sessions and blocks new ones is:

```powershell
Set-Mailbox leaver@example.com -AccountDisabled:$true
```

**When the leaver is hostile,** do this step before telling them, not after. Microsoft's own figures run from 30 minutes to 24 hours depending on the action, and Google's pages give no timing at all.

## Step 2: Wipe company data from phones

Both suites can remove work data from a phone without wiping the whole device. In Google Workspace, the [security checklist](https://knowledge.workspace.google.com/admin/users/maintain-data-security-after-an-employee-leaves) says a remote wipe can cover the whole device or only the organization's data.

In Microsoft 365, the [step 3 page](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-3) uses the Exchange admin center. Go to **Recipients > Mailboxes**, select the user and open **Manage mobile devices**. Pick the device, choose an option such as **Account Only Remote Wipe Device**, then **Block access**.

**Trade-off:** a full wipe on a personal phone erases the owner's own data. Use the account-only option unless the device belongs to the company.

## Step 3: Keep the mail flowing to someone

Microsoft's step 4 points out that customers and partners may keep sending mail to the old address. Decide who gets those messages before the account changes state.

**Google Workspace.** Gmail is deleted with the account, so either migrate it to another user or redirect new mail. Google's [delete page](https://knowledge.workspace.google.com/admin/users/delete-or-remove-a-user-from-your-organization) lists both.

The redirect lives in **Apps > Google Workspace > Gmail > Routing**, under **Email forwarding using recipient address map**, per Google's [redirect page](https://knowledge.workspace.google.com/admin/gmail/advanced/redirect-or-forward-gmail-messages-to-another-user). Enter the old address and the new recipient, and leave **Also route to original destination** unchecked for a pure redirect. Google says changes "can take up to 24 hours".

One gap: that redirect page does not say whether a map keeps working after the account is deleted. Google's delete page does say the address itself is removed about 20 days after deletion and can be reassigned sooner. Test the redirect on a deleted account in a quiet week before you rely on it.

**Microsoft 365.** Microsoft's [step 4](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-4) offers forwarding or a shared mailbox. Forwarding sends only new mail. A shared mailbox keeps all the old mail and calendar too, and, per the [conversion page](https://learn.microsoft.com/en-us/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox), needs no license while it stays under 50 GB.

The conversion page has three traps. The mailbox must still have a license when you convert it, or "you won't see the option to convert the mailbox." If you skip the password reset, "the original username and password will continue to work on the shared mailbox." And a hold on a shared mailbox needs an Exchange Online Plan 2 license, or Plan 1 with the Exchange Online Archiving add-on.

**When not to use a shared mailbox:** if the mailbox is over 50 GB and you do not want to keep paying for a license, export it instead. Microsoft's [step 5](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-5) describes exporting to a `.pst` file from the Outlook desktop app.

## Step 4: Hand over the files

**Google Workspace.** The transfer tool is at **Apps > Google Workspace > Drive and Docs > Transfer ownership**, per Google's [transfer page](https://knowledge.workspace.google.com/admin/drive/transfer-drive-files-to-a-new-owner-as-an-admin). Google suggests suspending the old owner first so they cannot move files mid-transfer. The new owner must have "an active account, not suspended, archived, or deleted", and the old owner must not be on litigation hold.

Three limits catch people out. "Items in Trash are not transferred." Files cannot move to an account outside your organization. And "If a transfer takes longer than 36 hours, it's unsuccessful and will stop," so start big transfers days before the deletion, not the hour before.

Files in shared drives need no transfer: Google says the organization owns them.

**Microsoft 365.** OneDrive is handed over by default when the account is deleted. Microsoft's [OneDrive retention page](https://learn.microsoft.com/en-us/sharepoint/retention-and-deletion) says the user's manager gets access automatically, with an email. A reminder follows "Seven days before the OneDrive retention period expires."

That depends on two things: the **Enable access delegation** setting under **My Site Cleanup** in the SharePoint admin center, and a manager set in Microsoft Entra ID. Without either, Microsoft says, "no one has automatic access." So set a secondary owner in the same place.

To move files yourself, Microsoft's [step 5](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-5) uses **Users > Active users**, the user, **OneDrive**, **Create link to files**. One catch: "When you move or copy documents that have version history, only the latest version is moved."

## Step 5: Clear the calendar before the account goes

Meetings outlive their organizer and keep rooms booked. Google's [calendar page](https://knowledge.workspace.google.com/admin/calendar/cancel-or-transfer-events-or-secondary-calendars-before-deleting-a-user) says events of a deleted user "can block other calendars and meeting rooms and resources," with no organizer left to change or cancel them.

**Google Workspace.** Under **Apps > Google Workspace > Calendar > Event and Secondary calendar management**, use **Events transfer**.

Only future, non-private events from the primary calendar that have at least one guest or resource move; private events are canceled. Secondary calendars need their own **Secondary calendar transfer**, because deleting the owner deletes them for good. The transfer starts about 10 minutes after you click and can take up to 15. A setting named **Silently cancel future events of deleted users** cancels what is left 21 days after deletion.

**Microsoft 365.** Microsoft's [step 4](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-4) simply says to cancel all the leaver's meetings. Rooms and equipment those meetings booked stay unavailable "until those meetings are canceled."

## Step 6: Stop paying, without starting a data clock you missed

This is where the two suites differ most, and where Microsoft's own pages disagree with each other.

**Google Workspace.** Suspending saves nothing: Google's [suspend page](https://knowledge.workspace.google.com/admin/users/suspend-a-user-temporarily) says suspended accounts are charged at the same rate on both the Flexible and Annual plans. Deleting cuts the bill on the Flexible plan. On an Annual or Fixed-Term plan, Google's [delete page](https://knowledge.workspace.google.com/admin/users/delete-or-remove-a-user-from-your-organization) says deleting "doesn't reduce your licenses or affect billing"; you reassign the seat instead.

**Microsoft 365.** Microsoft's [step 6](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-6) says that once a license is removed, "that user's data is held for 30 days." After that the content, "except for documents stored in SharePoint," is deleted for good. Microsoft treats the bill as a separate step: unassigning the license frees the seat, and you lower the seat count under **Billing > Your products > Remove licenses**.

The overview page says something we could not square with Microsoft's newer OneDrive rules. It says that if you remove a license but keep the account, the OneDrive "remains accessible to you even after 30 days." Microsoft's page on [unlicensed OneDrive accounts](https://learn.microsoft.com/en-us/sharepoint/unlicensed-onedrive-accounts), updated in September 2026, says such accounts are "put into read-only mode after 60 unlicensed days and archived after 93 unlicensed days." From then on, neither admins nor users can open the content unless an admin assigns a license, turns on billing or takes another supported step.

Since July 1, 2026, an unlicensed OneDrive without billing turned on is at risk of deletion after 365 cumulative unpaid days, "even if retention policies, settings, or holds exist."

Archive storage is not free either. The same page lists a reactivation fee of $0.60 per GB and storage at $0.05 per GB per month once billing for unlicensed accounts is on. By our arithmetic, reactivating a 20 GB OneDrive costs $12 once. So if you keep a Microsoft account only to anchor a shared mailbox, move the files out of its OneDrive within 60 days.

## Step 7: Delete, then watch the clock

In Google Workspace, deletion runs from **Directory > Users**, **More options**, **Delete selected users**, where a super admin can also transfer data under **Data in other apps**. If a data transfer fails, Google says the deletion stops and the account stays intact. A [restore](https://knowledge.workspace.google.com/admin/users/restore-a-recently-deleted-user) works "up to 20 days after deleting it" and needs a free license. It usually takes up to 24 hours, "but in rare cases it can take up to 5 days."

In Microsoft 365, deletion is **Users > Active users**, the user, **Delete user**. The account "becomes inactive for approximately 30 days."

OneDrive follows its own track. It is kept 30 days by default, settable from 30 to 3,650 days in the [retention setting](https://learn.microsoft.com/en-us/sharepoint/set-retention). Then it spends 93 days in the recycle bin, restorable only with PowerShell.

If your accounts sync from an on-premises Active Directory, Microsoft says you must delete and restore them there, not in the Microsoft 365 admin center.

## A script that dates every deadline for each leaver

Counting days by hand for three leavers on two platforms is easy to get wrong. This Python script reads a CSV of leavers and prints every deadline above, sorted by date, with a note when one falls on a weekend. It also writes `offboarding.ics`, a calendar file you can import, with one all-day event per deadline. It needs Python 3.7 or later and nothing outside the standard library.

```python
"""Turn a list of leavers into dated offboarding deadlines and an .ics file.

Windows come from Google's and Microsoft's admin docs (read November 1, 2026).
CSV columns: name, platform (google or microsoft), delete_on (YYYY-MM-DD),
license_removed_on and onedrive_retention_days (both optional, Microsoft only).
Leave delete_on empty for a Microsoft account you keep (shared mailbox, forwarding).
"""
import csv, hashlib, sys
from datetime import date, datetime, timedelta, timezone

def d(n):
    return timedelta(days=n)

def google(row, delete_on):
    return [
        (delete_on - d(5), "Ask a Vault admin to lift any litigation hold (can take up to 48 hours)"),
        (delete_on - d(3), "Start Drive, calendar and mail transfers (a Drive transfer fails after 36 hours)"),
        (delete_on, "Delete the account (Gmail is deleted with it unless migrated)"),
        (delete_on + d(20), "Last day to restore the account; untransferred Drive files and calendars go"),
        (delete_on + d(21), "Future events cancelled, if 'Silently cancel future events of deleted users' is on"),
    ]

def microsoft(row, delete_on):
    lic = (row.get("license_removed_on") or "").strip()
    lic = date.fromisoformat(lic) if lic else None
    if delete_on is None and lic is None:
        raise ValueError("needs delete_on or license_removed_on")
    if lic and delete_on and lic > delete_on:
        raise ValueError("license_removed_on is after delete_on")
    out = []
    if lic:
        out.append((lic + d(30), "A user mailbox loses its data 30 days after the license went (convert to shared first)"))
    if delete_on is None:  # account kept, license removed: the unlicensed clock runs
        out += [
            (lic + d(60), "OneDrive turns read-only (60 unlicensed days)"),
            (lic + d(93), "OneDrive archived; reading it needs a license or paid reactivation"),
            (lic + d(365), "Unpaid OneDrive at risk of deletion (365 unpaid days)"),
        ]
        return out
    keep = int(row.get("onedrive_retention_days") or 30)
    if not 30 <= keep <= 3650:
        raise ValueError("onedrive_retention_days must be 30 to 3650")
    end = delete_on + d(keep)
    out += [
        (delete_on, "Delete the account (not if mail is forwarded or the mailbox is shared)"),
        (delete_on + d(30), "About the last day to restore the account"),
        (end - d(7), "Manager or secondary owner gets the 7-day OneDrive warning"),
        (end, f"OneDrive retention ends ({keep} days); OneDrive moves to the recycle bin"),
        (end + d(93), "OneDrive leaves the recycle bin (restore needs PowerShell until then)"),
    ]
    archive = (lic or delete_on) + d(93)
    if archive < end:  # still inside retention: it moves to the archive state
        out.append((archive, "OneDrive archived as unlicensed (93 unlicensed days)"))
    return out

RULES = {"google": google, "microsoft": microsoft}

def plan(rows):
    events, errors = [], []
    for i, row in enumerate(rows, start=2):  # line 1 is the header
        try:
            name = row["name"].strip()
            rule = RULES[row["platform"].strip().lower()]
            raw = (row.get("delete_on") or "").strip()
            delete_on = date.fromisoformat(raw) if raw else None
            if delete_on is None and rule is google:
                raise ValueError("google rows need delete_on")
            for day, text in rule(row, delete_on):
                events.append((day, name, text))
        except (KeyError, ValueError, AttributeError, TypeError) as e:
            errors.append(f"line {i}: skipped ({e!r})")
    events.sort()
    return events, errors

def escape(text):
    for a, b in (("\\", "\\\\"), (",", "\\,"), (";", "\\;")):
        text = text.replace(a, b)
    return text

def fold(line):
    # RFC 5545: lines over 75 octets continue on the next line after a space.
    out = []
    while len(line.encode()) > 75:
        cut = 75
        while len(line[:cut].encode()) > 75:
            cut -= 1
        out.append(line[:cut])
        line = " " + line[cut:]
    return "\r\n".join(out + [line])

def ics(events):
    stamp = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%SZ")
    lines = ["BEGIN:VCALENDAR", "VERSION:2.0", "PRODID:-//offboard-dates//EN"]
    for day, name, text in events:
        # Same leaver + same step = same UID, so re-importing updates, not duplicates.
        uid = hashlib.sha1(f"{name}|{text}".encode()).hexdigest()
        summary = escape(f"{name}: {text}")
        lines += ["BEGIN:VEVENT", f"UID:{uid}@offboard",
                  f"DTSTAMP:{stamp}",
                  f"DTSTART;VALUE=DATE:{day:%Y%m%d}",
                  f"DTEND;VALUE=DATE:{day + d(1):%Y%m%d}",
                  f"SUMMARY:{summary}", "END:VEVENT"]
    lines.append("END:VCALENDAR")
    return "\r\n".join(fold(x) for x in lines) + "\r\n"

if __name__ == "__main__":
    with open(sys.argv[1], newline="", encoding="utf-8-sig") as f:
        events, errors = plan(list(csv.DictReader(f)))
    for day, name, text in events:
        flag = "  (weekend: plan for the Friday before)" if day.weekday() >= 5 else ""
        print(f"{day} {day:%a}  {name}: {text}{flag}")
    for e in errors:
        print(e, file=sys.stderr)
    if not events:
        print("no deadlines (empty or invalid input)", file=sys.stderr)
    with open("offboarding.ics", "w", encoding="utf-8", newline="") as f:
        f.write(ics(events))
```

The input looks like this. These rows are made up for the test; no real person or company is behind them.

```text
name,platform,delete_on,license_removed_on,onedrive_retention_days
Sample A,google,2026-12-04,,
Sample B,microsoft,2026-12-11,2026-12-01,
Sample J,microsoft,,2026-12-07,
```

## The test run found a mailbox that dies before its account

We ran it with Python 3.11 on November 1, 2026, on 11 sample rows: four Google, six Microsoft and one for an unsupported platform. Five rows were bad on purpose, and the script skipped each with a reason. They had an unknown platform, a month 13 and a license removed after the deletion date. One was a Google row without a deletion date, and one set a OneDrive retention of 10 days, below Microsoft's minimum of 30.

The six good rows produced 31 deadlines, 7 of them on a weekend. Here are the lines for the three rows above:

```text
2026-11-29 Sun  Sample A: Ask a Vault admin to lift any litigation hold (can take up to 48 hours)  (weekend: plan for the Friday before)
2026-12-01 Tue  Sample A: Start Drive, calendar and mail transfers (a Drive transfer fails after 36 hours)
2026-12-04 Fri  Sample A: Delete the account (Gmail is deleted with it unless migrated)
2026-12-11 Fri  Sample B: Delete the account (not if mail is forwarded or the mailbox is shared)
2026-12-24 Thu  Sample A: Last day to restore the account; untransferred Drive files and calendars go
2026-12-25 Fri  Sample A: Future events cancelled, if 'Silently cancel future events of deleted users' is on
2026-12-31 Thu  Sample B: A user mailbox loses its data 30 days after the license went (convert to shared first)
2027-01-03 Sun  Sample B: Manager or secondary owner gets the 7-day OneDrive warning  (weekend: plan for the Friday before)
2027-01-06 Wed  Sample J: A user mailbox loses its data 30 days after the license went (convert to shared first)
2027-01-10 Sun  Sample B: About the last day to restore the account  (weekend: plan for the Friday before)
2027-01-10 Sun  Sample B: OneDrive retention ends (30 days); OneDrive moves to the recycle bin  (weekend: plan for the Friday before)
2027-02-05 Fri  Sample J: OneDrive turns read-only (60 unlicensed days)
2027-03-10 Wed  Sample J: OneDrive archived; reading it needs a license or paid reactivation
2027-04-13 Tue  Sample B: OneDrive leaves the recycle bin (restore needs PowerShell until then)
2027-12-07 Tue  Sample J: Unpaid OneDrive at risk of deletion (365 unpaid days)
```

Sample B shows the trap we did not expect: its license was removed 10 days before the account was deleted. By Microsoft's documented windows, the mailbox data is gone on December 31, while the account itself can still be restored until about January 10. By our reading, restoring the account in that gap would bring back an account without its old mail. Remove the license on the day you delete, or convert the mailbox first.

**Checks on the output.** The calendar file parsed cleanly with the Python `icalendar` library: 31 events, 31 distinct IDs, and no line over 75 bytes, the limit the [iCalendar standard](https://www.rfc-editor.org/rfc/rfc5545) asks for. Names with commas, semicolons, backslashes and non-English letters came through intact. Running the script twice gave the same events with the same IDs, so a calendar app should update them on re-import rather than add copies. Empty input and a header-only file print "no deadlines" instead of crashing.

**Limits of the script.** It counts calendar days from dates you type; it does not read your tenant. Two leavers with the same name would share event IDs, so add a surname or an employee number. Changing a row's retention period changes the event text and therefore its ID, so delete the old event by hand. And the windows are the vendors' current figures; Microsoft's own pages already disagree on the unlicensed OneDrive, so check them again before you trust a date months away.

## The checklist to copy

Paste this into a ticket for each leaver. Every line points back to a section above.

```text
LEAVER: ____________  LAST DAY: ________  PLATFORM: Google / Microsoft
Path chosen:  [ ] delete  [ ] keep (archive / shared mailbox)  [ ] suspend for now

Before telling the leaver (if the exit is not friendly)
[ ] Reset password
[ ] Google: reset sign-in cookies (or Directory API signOut)
[ ] Microsoft: Sign out of all sessions, or Revoke-MgUserSignInSession
[ ] Microsoft: Block sign-in (can take up to 24 hours)
[ ] Remove recovery email and phone; revoke app passwords and OAuth tokens

Last day
[ ] Account-only wipe on phones (full wipe only on company devices)
[ ] Mail: Google redirect or migration / Microsoft shared mailbox or forwarding
[ ] Microsoft: convert to shared BEFORE removing the license (under 50 GB = no license)

Before deletion (start at least 3 days ahead)
[ ] Google: Vault admin lifts any hold (up to 48 hours)
[ ] Google: Drive transfer to an active user (fails after 36 hours; Trash not included)
[ ] Google: transfer events and secondary calendars
[ ] Microsoft: manager or secondary owner set for OneDrive access
[ ] Microsoft: cancel meetings that book rooms or equipment
[ ] Move anything in a kept Microsoft account's OneDrive out within 60 days

Licenses and deletion
[ ] Google Flexible: delete to stop billing / Annual: reassign the seat
[ ] Microsoft: remove license, then Billing > Your products > Remove licenses
[ ] Delete (never a Microsoft account that anchors forwarding or a shared mailbox)
[ ] Run the deadline script and import offboarding.ics
```

The one step to do today, before anyone leaves: in the SharePoint admin center, confirm **Enable access delegation** is on and set a secondary owner. It is one setting, and without it Microsoft says no one gets a deleted user's OneDrive.

## How we made this

On November 1, 2026, we read Google's Workspace admin pages on removing users and transferring their data. We also read Microsoft's seven-step offboarding series with its linked OneDrive, shared mailbox and PowerShell pages. We wrote the deadline script from those pages and ran it that day with Python 3.11 on 11 made-up rows (five deliberately invalid) and on empty files, then checked the calendar file with the `icalendar` library. We did not run any step in a real Google Workspace or Microsoft 365 tenant, so the menu paths and delays are the vendors' documented ones, not timings we measured.

## Sources

- Google, [Delete or remove a user from your organization](https://knowledge.workspace.google.com/admin/users/delete-or-remove-a-user-from-your-organization)
- Google, [Maintain data security after an employee leaves](https://knowledge.workspace.google.com/admin/users/maintain-data-security-after-an-employee-leaves)
- Google, [Sign a user out of a managed Google Account](https://knowledge.workspace.google.com/admin/devices/sign-a-user-out-of-a-managed-google-account) and [Reset a user's password](https://knowledge.workspace.google.com/admin/users/reset-a-users-password)
- Google, [Directory API: users.signOut](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/signOut)
- Google, [Suspend a user temporarily](https://knowledge.workspace.google.com/admin/users/suspend-a-user-temporarily) and [Archive former employee accounts](https://knowledge.workspace.google.com/admin/users/archive-former-employee-accounts)
- Google, [Transfer Drive files to a new owner as an admin](https://knowledge.workspace.google.com/admin/drive/transfer-drive-files-to-a-new-owner-as-an-admin)
- Google, [Redirect or forward Gmail messages to another user](https://knowledge.workspace.google.com/admin/gmail/advanced/redirect-or-forward-gmail-messages-to-another-user)
- Google, [Cancel or transfer events or secondary calendars before deleting a user](https://knowledge.workspace.google.com/admin/calendar/cancel-or-transfer-events-or-secondary-calendars-before-deleting-a-user)
- Google, [Restore a recently deleted user](https://knowledge.workspace.google.com/admin/users/restore-a-recently-deleted-user)
- Microsoft, [Remove a former employee: overview](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee) and steps [1](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-1), [2](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-2), [3](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-3), [4](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-4), [5](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-5), [6](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-6) and [7](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-7)
- Microsoft, [Convert a user mailbox to a shared mailbox](https://learn.microsoft.com/en-us/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox)
- Microsoft, [OneDrive retention and deletion](https://learn.microsoft.com/en-us/sharepoint/retention-and-deletion) and [Set the OneDrive retention for deleted users](https://learn.microsoft.com/en-us/sharepoint/set-retention)
- Microsoft, [Manage unlicensed OneDrive user accounts](https://learn.microsoft.com/en-us/sharepoint/unlicensed-onedrive-accounts), updated September 2, 2026
- Microsoft, [Revoke-MgUserSignInSession](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users.actions/revoke-mgusersigninsession)
- IETF, [RFC 5545: iCalendar](https://www.rfc-editor.org/rfc/rfc5545), section 3.1 on line folding