Deleting Cloud Identity Users with GCDS

This document outlines the best four-phase strategy for controlled, permanent deletion of Cloud Identity users using Google Cloud Directory Sync (GCDS). This approach uses a suspension phase (“safety net”) to minimize the risk of accidental permanent data loss.

CRITICAL: Before You Begin (Data & Ownership Checks)

Deletion is permanent and irreversible. Ensure the following critical prerequisites are met before proceeding:

• Confirm Data Loss: Deleting a user permanently deletes all their associated data.
• Google Workspace Data: If users held a Google Workspace license (Gmail, Drive, Calendar), all their data will be permanently deleted. You must back it up first.
• Cloud Identity Data: If they were “Cloud Identity Free” users, check for GCP project ownership.
• GCP Project Ownership: If any user owns a Google Cloud Platform (GCP) Project, deleting their identity will not delete the project, but it will orphan the project, making it inaccessible. You must change the ownership of any GCP projects before deleting the users.
• Stop Automatic Syncs: Disable the scheduled task or cron job running the GCDS sync on your server. This process requires full manual control.

4-Phase User Deletion Strategy

Phase 1: Isolate Users in Active Directory

The first step is to isolate the user accounts intended for deletion within your on-premises Active Directory (AD).

1. Create a New Organizational Unit (OU): In your AD, create a new OU, such as OU=To_Be_Deleted_From_Google.
2. Move Users to New OU: Move all the specific user accounts you wish to delete from Google into this new OU. This signals to GCDS which users should be removed from the sync scope.

Phase 2: Suspend the Users (The “Safety Net”)

This phase suspends the users in Google Cloud, preventing login access while temporarily preserving their data.

1. Open GCDS Configuration Manager.
2. Modify Your User Search Rule:

• Go to the “User Accounts” tab.
• Select the “Search Rules” tab.
• Find your main user search rule and click “Add Exclusion Rule”.
• Set the exclusion rule to filter out the new OU:
• Type: OrgUnit
• Match Type: Substring
• Rule: OU=To_Be_Deleted_From_Google

3. Change Your Deletion Policy:

• Go to the “General Settings” tab.
• Under “User Deletion Policy”, select: “Suspend users that are not found in LDAP”

4. Run a Simulation:

• Go to the “Sync” tab and click “Simulate”.
• Critically Review the Log: The log must show a list of users to be suspended.
• Ensure the count and specific users are correct.

5. Run the Manual Sync:

• If the simulation is correct, run the sync manually (using “Sync & Apply” or sync-cmd).
• The target users are now suspended and cannot log in, but their data is preserved.

Phase 3: The Waiting Period

This is the required cooling-off period to verify that the suspended accounts are not needed by anyone.

1. Wait for 3–7 days.

2. Monitor for Issues: Observe if any teams report issues related to the suspended accounts.

3. Rollback Option: If a user was suspended by mistake, you can “Un-suspend” them in the Google Admin Console and move them back to the correct OU in AD, effectively reversing the mistake.

Phase 4: Delete the Users (The Final Step)

After the waiting period, you can now use GCDS to permanently delete the accounts.

1. Open GCDS Configuration Manager.
2. Change Your Deletion Policy:

• Go to the “General Settings” tab.
• Change the “User Deletion Policy” to: “Delete users that are suspended for 7 days” (or however long you waited). This is the safest final deletion option.

3. Run a Simulation:

• Go to the “Sync” tab and click “Simulate”.
• Review the log one last time to confirm the list of users scheduled for deletion.

4. Run the Manual Sync:

• Run the sync manually.
• GCDS will now permanently delete all users who have been in a suspended state for the specified duration.

By following this four-phase approach, you ensure a professional and secure offboarding process that prioritizes data integrity over speed. Moving from isolation to suspension provides a vital buffer against human error, allowing you to catch potential issues before they become permanent.

Once the final sync is complete and the accounts are purged, you can confidently re-enable your scheduled sync tasks, knowing your Cloud Identity environment is clean, organized, and free of orphaned accounts.