Google Workspace - email only?

[Koldov]

Long story, but as the title says I'm looking for a way to 'downgrade' a Google Workspace account to email only.

 

A member of SLT is leaving this week, they've been here 16 years since starting their teaching 'journey' and so this is absolutely massive for both them and for the school (they are well liked and bring a great deal to the school in terms of leadership, T&L and general school/teachery type stuff)...

 

However, I reminded them that on the day of their leaving all accounts would be deleted including all their work, both on the server and in Google also that their laptop and iPad would be collected and wiped... Well this brought about a mini meltdown as they pretty much have their whole life's work on the server and on their laptop (I understand they are under a lot of stress to get everything done and sorted before they leave and they do have quite a lot of responsibilities).

 

Anyway, we've pretty much got it all sorted and then I dropped the bombshell about them not being able to access GMail either... well the thing is they are in the middle of mentoring an NQT and have quite a few loose ends with various other organisations.

 

Unfortunately having spoken to the Head I've been told to leave the account as is because of the above (but it's against policy so I'll get it in a written confirmation).

 

I thought about forwarding but their new school hasn't set-up an email account for them (maybe I could move their account into some sort of OU with only GMail enabled?). I can't even suspend their account, because I don't think you could suspend a user and still have their mail forwarded?

[flyinghaggis]

Long story, but as the title says I'm looking for a way to 'downgrade' a Google Workspace account to email only.

 

In theory you can do this if you go to the admin console, move the user to a different organisation unit and disable services other than the ones required (so that only Gmail is enabled for that org unit they're now in).

 

I think that would accomplish what you're after.

 

https://admin.google.com/ac/appslist/core

[jthompson]

Create a specific OU and disable all the Google services apart from Gmail (and perhaps Contacts, too) for their account to sit in.

 

If you have local AD and use GCDS to keep Google accounts in sync, you may want to disable their AD account, so that it can't be used to access any Windows stuff.

 

We've had similar arrangements for staff who've left/retired but stayed on in some voluntary capacity for a period. In those instances we've left them with Google Drive available as well though, so can't speak as to how well things work if Drive isn't available. HR make them sign the usual data protection agreement, etc.

 

I'd avoid automatically forwarding emails if you can. That won't really encourage them to unpick temselves from your domain, which is what it sounds like you need them to do.

[paulkerton]

Long story, but as the title says I'm looking for a way to 'downgrade' a Google Workspace account to email only.

 

A member of SLT is leaving this week, they've been here 16 years since starting their teaching 'journey' and so this is absolutely massive for both them and for the school (they are well liked and bring a great deal to the school in terms of leadership, T&L and general school/teachery type stuff)...

 

However, I reminded them that on the day of their leaving all accounts would be deleted including all their work, both on the server and in Google also that their laptop and iPad would be collected and wiped... Well this brought about a mini meltdown as they pretty much have their whole life's work on the server and on their laptop (I understand they are under a lot of stress to get everything done and sorted before they leave and they do have quite a lot of responsibilities).

 

Anyway, we've pretty much got it all sorted and then I dropped the bombshell about them not being able to access GMail either... well the thing is they are in the middle of mentoring an NQT and have quite a few loose ends with various other organisations.

 

Unfortunately having spoken to the Head I've been told to leave the account as is because of the above (but it's against policy so I'll get it in a written confirmation).

 

I thought about forwarding but their new school hasn't set-up an email account for them (maybe I could move their account into some sort of OU with only GMail enabled?). I can't even suspend their account, because I don't think you could suspend a user and still have their mail forwarded?

 

Just allow them to use Google Takeout?

One day people will realise that their work account is not their personal account.

[3s-gtech]

Do not *do not* setup up forwarding of emails from one organisation to another. The DP breach could be spectacular. As it is, having a non-employee access school services is seriously shaky and needs very specific written instruction from the head (and ideally your DPO).

 

It's fine. Depending on contract, you can probably leave them to still have access until the end of December or even the Christmas holiday. Plenty of time for them to sort it.

[mavhc]

Sign them up to standard gmail surely

[dmj]

Doesn't Ofsted give an instant "inadequate" to the whole organisation if they don't have safeguarding information protected from third parties, ie people not covered by a contract?

Seems the word 'policy' is quite flexible here.

Give them the export and send them on their way: https://support.google.com/a/answer/100458?hl=en

[dmj]

Do you delete the user and their files straight away e.g day after leave date?

 

Disable the account and remove any keys/tokens. Then delete after 12months was our policy.

[Koldov]

So, what is the problem with has been suggested?

 

Their AD account will be disabled, their laptop will be returned and wiped, their iPad will be returned and wiped and the Google account will be moved to an OU with no access to anything other than their GMail account.

 

We don't use Google as much as some other schools and we don't have it integrated with anything, or have any staff file shares on it (in fact we barely use it at all, only for some computing lessons as the 'consultant' who provided all the computing curriculum resources/planning decided that's the way we should go)... so, no 'safeguarding' information.

 

Although I understand there's guidance to stop the wholesale opening up of sensitive data to 'all and sundry' and in the most extreme case of a data breach that can be traced back to this users email account I guess we would be in trouble, but in this case I'm not seeing any reason for the spectre of Ofsted to be mentioned and I don't see them suddenly swooping in like an FBI sting operation to hang a big 'inadequate' banner on the gates (I mean there's nobody sitting in a van outside monitoring all our communications)...

 

Oh, who's that outside the window...

 

Wait...

 

FLASHBANG!!!!

 

 

Sorry... too much Counterstrike last night...

[jthompson]

Off topic with regard to the OP, but in repsonse to the 'Google Takeout' suggestions, doesn't that pose a data breach risk in and of itself? We have it turned off. IMHO encouraging someone to be more selective in what they choose to take away with them from Drive would be preferable to an indiscriminate dump of Gmail, Drive, etc. via Takeout.

[Ditto]

I hope a solution is found that is secure, deals with all data protection requirement and keeps all parties content. However, it does remind me of the argument as to who owns 'the lifetimes work'. When employed as a programmer/software engineer, contracts were very clear about this. Didn't the early history of SIMS get wrapped up in this whole saga?

[mavhc]

What's wrong with them setting up their own normal gmail account?

[jmak]

So, what is the problem with has been suggested?

 

Their AD account will be disabled, their laptop will be returned and wiped, their iPad will be returned and wiped and the Google account will be moved to an OU with no access to anything other than their GMail account.

 

It depends what PII is in their school email account.

[3s-gtech]

It depends what PII is in their school email account.

This - entirely this.

[tylermoss]

Long story, but as the title says I'm looking for a way to 'downgrade' a Google Workspace account to email only.

 

A member of SLT is leaving this week, they've been here 16 years since starting their teaching 'journey' and so this is absolutely massive for both them and for the school (they are well liked and bring a great deal to the school in terms of leadership, T&L and general school/teachery type stuff)...

 

However, I reminded them that on the day of their leaving all accounts would be deleted including all their work, both on the server and in Google also that their laptop and iPad would be collected and wiped... Well this brought about a mini meltdown as they pretty much have their whole life's work on the server and on their laptop (I understand they are under a lot of stress to get everything done and sorted before they leave and they do have quite a lot of responsibilities).

All their access and rights will be revoked. Including enabling access to tutors on https://mysupergeek.com/ and other educational resources. Anyway, we've pretty much got it all sorted and then I dropped the bombshell about them not being able to access GMail either... well the thing is they are in the middle of mentoring an NQT and have quite a few loose ends with various other organisations.

 

Unfortunately having spoken to the Head I've been told to leave the account as is because of the above (but it's against policy so I'll get it in a written confirmation).

 

I thought about forwarding but their new school hasn't set-up an email account for them (maybe I could move their account into some sort of OU with only GMail enabled?). I can't even suspend their account, because I don't think you could suspend a user and still have their mail forwarded?

 

Why don't they take care of transferring the "whole life's work" and/or creating backups in advance? You can't be sure about how they will use these accounts later on.

Edited December 25, 2023 by tylermoss