Menu
Groove.id blog

Delegating suspended users’ email in G Suite with Groove.id

by Chris Dzombak, Principal Software Engineer

When an employee leaves your company, best practice is to suspend their user account in Google’s G Suite. This blocks their access to Google services, along with any services which your users sign into via Google, but leaves their documents and email intact. (To stop billing for the user, you can delete their account post-suspension.)

One catch: though their existing email is not deleted, suspended G Suite users can’t receive new email. Surprisingly, G Suite doesn’t provide a straightforward way for a suspended user’s email address to continue receiving mail. This is a problem in many organizations; consider, for example, a sales team who wants to ensure they don’t drop messages from leads when a colleague leaves the company.

There are a few common workarounds — for example, adding the user’s email address as an alias for their manager — but these come with disadvantages. In that example, the manager will show up in the Gmail autocomplete menu when someone begins typing the former employee’s address, and this solution only allows a single person to receive these emails.

Groove.id’s account automation to the rescue! We can solve this problem for you.

When you suspend a G Suite user in the Groove.id console, we’ll also create a Google Group which will receive any new email addressed to the suspended user. We call this an “email archive group.” Then, you can use the standard Google Group access controls to delegate access to those emails, and even control who can respond from the user’s old email address.

If you re-enable the user in the Groove.id console, the email archive group sticks around, but new emails are once again directed to the user’s Google inbox.

Artifacts you’ll see when using this feature

When you’re using email archive groups (enabled by default when using Groove.id to manage G Suite users), you’ll notice a side effect: when suspending a user, their email address gets “.suspended” appended to it — so “alice@example.com” becomes “alice.suspended@example.com”. This is just because we need to free up the original address, so we can assign it to the email archive group. When you re-enable the user, Groove.id removes the “.suspended” text from their address; everything goes back to normal.

To disable email archive groups, navigate to the Settings page for your G Suite app in the Groove.id console. Uncheck the “Create an email archive group to receive emails when disabling a user” option, and click Save.