Suspend account
Google SSO is blocked, sessions are revoked, and directory state is ready for review.
Close the gap after a user is suspended in Google.
Use this checklist to move from account suspension to verified app-level access review and defensible offboarding evidence.
- Google Admin
- SaaS access review
- SOC 2 evidence
Google suspension does not prove every app account is closed.
The checklist separates identity suspension from app-level access review so IT, security, and HR ops can see what remains before evidence is exported.
Suspension is the start. App-level proof closes the case.
SaaS
Verify app access
Direct app accounts, groups, OAuth grants, and shared access are checked before closure.
Evidence
Export reviewed proof
Reviewer notes, timestamps, unresolved exceptions, and report output stay attached.
Use the checklist to preserve handoff ownership before the final report is exported.
Step 1
Before the last day
- Confirm the employee record, manager, department, and planned termination date.
- Identify critical apps used outside Google SSO, including Slack, GitHub, finance, support, and CRM systems.
- Assign an owner for each app-level access review before the account is suspended.
Step 2
At termination
- Suspend the Google Workspace account and revoke active sessions.
- Remove group memberships that grant shared-drive, app, or mailing-list access.
- Transfer Drive ownership or preserve data according to company retention policy.
Step 3
After Google is disabled
- Review downstream SaaS accounts that may stay active after SSO is blocked.
- Mark each app as revoked, unknown, or requiring follow-up with reviewer attribution.
- Capture timestamps, reviewer notes, and unresolved exceptions before closing the ticket.
Step 4
For audit evidence
- Keep the reviewed access record, not only the original checklist.
- Export evidence after active and unknown access are resolved.
- Retain report hashes, export timestamps, and reviewer context with the offboarding record.