Employee Offboarding Setup Guide

Wire up automated Google Workspace offboarding. This n8n workflow notifies every team, suspends the account on the last day, and logs it all in a Google Sheet.

The workflow automates employee offboarding. When an offboarding form is submitted, the workflow notifies IT, payroll, the manager, and the employee, then suspends the Google Workspace account on the employee's last day.

It uses Gmail, Google Sheets, and a Google Service Account with Domain-Wide Delegation to call the Admin SDK on your behalf. Three credentials in n8n.

How the Flow Works

1. HR submits the offboarding form: The Google Form submission triggers an Apps Script on the linked Sheet. The script reads the new row by header name and posts the form data (signed with HMAC) to the n8n form webhook.

2. n8n validates and creates a Sheet record: The workflow checks for missing fields (employee email, last day, manager email, IT email, payroll email) and confirms the suspension date is not before the last day. If valid, a new row is written to the Sheet with Status = Pending. The employee email must be in your workspace domain; if not, the row is marked as a duplicate.

3. n8n notifies IT, payroll, the manager, and the employee: Four emails go out immediately with the offboarding details. Each one includes the relevant context (equipment return instructions for IT, final pay timing for payroll, transition notes for the manager, farewell for the employee).

4. n8n waits until the suspension date: The workflow sleeps until the configured suspension date (defaults to the last day).

5. n8n suspends the Google Workspace account: On the suspension date, the workflow calls the Admin SDK via the Service Account to suspend the user's Google account.

6. Already-processed protection: If the same form row is submitted twice (or a duplicate is detected), the workflow skips notification and suspension and logs a duplicate error so HR can investigate.

Form Fields and Sheet Columns

The Google Form must have these six fields, in any order. The Apps Script matches them by header label, not position, so you can reorder the form fields freely:

Form field	Sheet column header	Required?
Employee name	Employee name	Yes
Employee email	Employee email	Yes
Manager name	Manager name	No
Manager email	Manager email	Yes
Last day	Last day	Yes
Reason	Reason	No

The workflow writes these columns to the sheet automatically:

Column	Set by	When
Status	n8n	Pending on form submit, Suspended after Admin SDK call
Suspension date	n8n	If not in form, defaults to last day
Decision timestamp	n8n	When the account is suspended

In addition, the Apps Script setup function creates an Error Log tab with these columns:

Column	Type	Description
timestamp	date	ISO 8601, logged when an error occurs
error_type	string	validation_error, duplicate_error, or step_failure
employee_email	string	From the triggering record
employee_name	string	From the triggering record
node_name	string	Which node failed
error_message	string	Human-readable cause
resolved	string	Always "No" on insert; edit to "Yes" when resolved

The Error Log tab stays empty during normal operation. It only gets populated when something fails (missing fields, API errors, etc.).

---

Copy the Google Form and Google Sheet

1. Visit tl-hr.com and enter your license key to access the configurator
2. Download your pre-configured workflow and copy the Google Form and Google Sheet templates provided
3. Make copies of both into your Google Workspace account
4. Note: copying does not carry over the connection between the form and sheet. You will need to reconnect them in Google Forms (Responses tab → Link to Sheets → Select the copied sheet)

---

Create/Setup Google Cloud Project (if not created yet)

Enable Gmail API (skip if already done)

1. Go to console.cloud.google.com
2. Select your project
3. In the left sidebar, go to APIs & Services → Library
4. Search for Gmail API
5. Click on Gmail API in the results
6. Click Enable

Enable Google Sheets API (skip if already done)

1. Go to console.cloud.google.com
2. Select your project
3. In the left sidebar, go to APIs & Services → Library
4. Search for Google Sheets API
5. Click on Google Sheets API in the results
6. Click Enable

Create OAuth Consent Screen (skip if already done)

1. Go to APIs & Services → OAuth consent screen
2. Choose Internal (since this is for internal use)
3. Click Create
4. Fill in the required fields:
   • App name (e.g. "n8n")
   • User support email: select your email from the dropdown
   • Developer contact email: enter your email
5. Click Save and Continue
6. On the Scopes step, click Save and Continue: you can skip adding scopes here since n8n handles this automatically
7. Click Back to Dashboard

Create OAuth Client (skip if already done)

1. Go to console.cloud.google.com
2. Select your project
3. Go to APIs & Services → Credentials
4. Click Create credentials → OAuth client ID
5. Application type → Web application
6. Name the OAuth client (e.g. "n8n")
7. Authorized redirect URIs → https://your-n8n.com/rest/oauth2-credential/callback
8. Click Create
9. Copy Client ID and Client Secret

Note: You will only see the client secret once, so make sure to copy and/or download the JSON.

---

Enable the Admin SDK API (skip if already done)

The Admin SDK API must be enabled in your Google Cloud project before the Service Account can use it.

1. Go to console.cloud.google.com
2. Select your project
3. Go to APIs & Services → Library
4. Search for Admin SDK API
5. Click Admin SDK API
6. Click Enable
7. Wait 1-2 minutes for the change to propagate

If you skip this step, the Suspend Google Account node will fail with: Admin SDK API has not been used in project [PROJECT_ID] before or it is disabled.

---

Create the Service Account (skip if already done)

1. Go to console.cloud.google.com
2. Select your project
3. Go to APIs & Services → Credentials
4. Click Create Credentials → Service Account
5. Give it a name (e.g. "n8n-service-account")
6. Copy the service account email address (e.g. n8n-service-account@project-name.iam.gserviceaccount.com)
7. Click Create and Continue: skip the optional role and user access steps
8. Click Done

Warning: New Google Workspace organizations have the following org policies enforced by default which will block service account and key creation:

• iam.managed.disableServiceAccountCreation
• iam.disableServiceAccountKeyCreation
• iam.managed.disableServiceAccountKeyCreation

Before creating your service account key, you must temporarily unenforce these policies:

1. Go to console.cloud.google.com
2. In the top search bar, search for Organization Policies
3. Note: The console only shows 50 policies at a time by default. Scroll past the first 50 or search by name to find each policy
4. For each of the three policies listed above, click on it, select Override parent's policy, set to Not enforced, and save

Create a JSON Key (skip if already done)

1. Click on your newly created service account
2. Go to the Keys tab
3. Click Add Key → Create new key
4. Choose JSON and click Create
5. The key file will download automatically
6. Open n8n and import the key immediately (covered in the Connect Credentials section below)
7. Delete the JSON file from your Downloads folder after importing
8. If you need to keep a backup, store it somewhere secure. Not your Desktop, not email, and not a shared drive

Enable Domain-Wide Delegation (skip if already done)

1. Go to the Details tab of your service account
2. Click the Advanced settings tab
3. Note the Client ID shown: you will need this in the next step

Authorize in Google Workspace Admin Console

1. Go to admin.google.com

2. Go to Security → Access and data control → API controls

3. Scroll down and click Manage Domain Wide Delegation

4. Find your Service Account's existing entry in the list and click Edit. If no entry exists yet, click Add new instead.

5. Paste in the Service Account Client ID (if adding new) or confirm it matches (if editing)

6. In the OAuth scopes field, add the following scope (if editing, append it to any existing scopes):

   https://www.googleapis.com/auth/admin.directory.user
   

   This is the only scope the Service Account needs for this workflow. Gmail and Google Sheets use separate OAuth2 credentials you will set up in n8n.

   Using multiple templates with the same Service Account? The combined scopes across all Domain-Wide Delegation-using templates are admin.directory.user (for onboarding and offboarding), calendar.events (for PTO), and spreadsheets.readonly (for PTO). Comma-separated scopes go in a single OAuth scopes field. Adding calendar.events, spreadsheets.readonly to an existing onboarding or offboarding Domain-Wide Delegation entry is all you need to also run PTO. Do not create a duplicate entry.

7. Click Authorize

Note: Domain Wide Delegation can take up to 24 hours to propagate but in my experience it updates fairly immediately.

---

Connect Credentials in n8n

Create the Gmail Credential (skip if already done)

1. Open your n8n instance
2. Click Overview in the left sidebar
3. Click Credentials
4. Click Create credential in the top right
5. Search and select Gmail OAuth2 API
6. Paste your Client ID and Client Secret from the OAuth client step
7. Click Sign in with Google
8. A browser window will open. Sign in with the Google Workspace admin account
9. Grant the requested permissions
10. You will be redirected back to n8n. The credential will show as connected

Create the Google Sheets Credential (skip if already done)

1. Open your n8n instance
2. Click Overview in the left sidebar
3. Click Credentials
4. Click Create credential in the top right
5. Search and select Google Sheets OAuth2 API
6. Paste your Client ID and Client Secret from the OAuth client step
7. Click Sign in with Google
8. A browser window will open. Sign in with the Google Workspace admin account
9. Grant the requested permissions
10. You will be redirected back to n8n. The credential will show as connected

Create the Google Service Account Credential (skip if already done)

When you create this credential in n8n, it is labeled Google Service Account (with DWD) by default. Keep that name during initial setup so the imported workflow auto-links the credential; after the link is established, n8n resolves it by credential ID at runtime, so any later rename is harmless.

1. Open your n8n instance
2. Click Overview in the left sidebar
3. Click Credentials
4. Click Create credential in the top right
5. Search and select Google Service Account API
6. Select the region closest to you (this does not matter)
7. Open the downloaded JSON key file. Find the Service Account Email (client_email) and paste it into the Service Account Email field
8. From the downloaded JSON, find the Private Key (private_key) and paste the full value into the private key field (everything between and including -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----\n)
9. Toggle Impersonate a User on and enter your email (the Google Workspace admin)
10. Toggle Set up for use in HTTP Request node on
11. Add the scope: https://www.googleapis.com/auth/admin.directory.user
12. Set Allowed HTTP Request Domains to Specific Domains and enter admin.googleapis.com
13. When all fields are complete, you should see Connection tested successfully

Required n8n credential settings for this workflow

The Service Account credential in n8n must have the following four settings configured correctly, otherwise the Suspend Google Account node will fail with Forbidden - perhaps check your credentials? / Request had insufficient authentication scopes.

To check or edit these on an existing credential:

1. Open your n8n instance
2. Click Overview in the left sidebar
3. Click Credentials
4. Find Google Service Account API in the list and click on it
5. Verify the Service Account Email field is filled in
6. Verify the Private Key field is filled in (starts with -----BEGIN PRIVATE KEY-----)
7. Verify Impersonate a User is toggled on, and the impersonated user is your Google Workspace admin email
8. Toggle Set up for use in HTTP Request node to on: this is required for the credential to work with HTTP Request nodes
9. In the Scope field, add https://www.googleapis.com/auth/admin.directory.user
10. Under Allowed HTTP Request Domains, select Specific Domains and enter admin.googleapis.com
11. Click Save
12. Click Connection test: it should report success

If any of these settings is wrong:

• "Set up for use in HTTP Request node" off → HTTP Request nodes cannot use the credential at all
• Scope missing admin.directory.user → Google rejects the Admin SDK call with insufficient scopes
• Allowed HTTP Request Domains missing admin.googleapis.com → HTTP Request nodes are blocked from calling the Admin SDK API

Common errors when setting up the Google Service Account

unauthorized_client

n8n validates all Domain-Wide Delegation scopes when authenticating, not just the ones your workflow uses. If any scope is missing the entire authentication fails. Make sure the full scope list is added exactly as shown in the Google Workspace Admin Console under Security → Access and data control → API controls → Manage Domain Wide Delegation. No extra spaces, no missing scopes.

invalid_grant (Private key validation failed)

This is usually a propagation delay. After setting up or updating Domain-Wide Delegation in the Admin Console, it can take up to a few hours to take effect. If you see this error immediately after setup, wait a few hours and try again before troubleshooting further.

Authorization failed - please check your credentials

The "Set up for use in HTTP Request node" toggle on the Google Service Account credential in n8n is turned off. Open the credential in Settings → Credentials and turn it on. This is required for the credential to work with an HTTP Request node.

Forbidden - Request had insufficient authentication scopes

The Admin SDK rejected the request because the OAuth token does not include the directory scope. Two things must both be true:

1. The n8n Service Account credential has https://www.googleapis.com/auth/admin.directory.user in its Scope field (per the Required n8n credential settings section above)
2. The Google Workspace Admin Console has the directory scope in the Service Account's Domain-Wide Delegation entry (per the Domain-Wide Delegation step in this guide)

If both are set, propagation may be the cause; Domain-Wide Delegation changes can take up to a few hours to take effect.

---

Re-enforce Organization Policies (skip if already done)

Once your service account credential is confirmed working in n8n, re-enforce the org policies to secure your Google Workspace:

1. Go to console.cloud.google.com

2. In the top search bar, search for Organization Policies

3. For each of the three policies below, click on it, select Override parent's policy, set to Enforced, and save:

   • iam.managed.disableServiceAccountCreation
   • iam.disableServiceAccountKeyCreation
   • iam.managed.disableServiceAccountKeyCreation

This ensures your organization is protected against unauthorized service account and key creation going forward.

Verify before moving on. All three policies should now read Enforced. If any still reads Not enforced, your Workspace org can still create service accounts and JSON keys without restriction. The workflow above this section will keep running either way, so this step won't fail loudly if it slips past you.

---

Find your Credential IDs in n8n (skip if already done)

Each credential you create in n8n has a unique ID. You need these IDs to configure your workflow.

1. Open your n8n instance
2. Click Credentials in the left sidebar
3. Find the credential you need and click on it to open it
4. Go to the Details tab
5. Copy the ID field

You need three credential IDs:

• Gmail OAuth2 credential ID
• Google Sheets OAuth2 credential ID
• Google Service Account credential ID

---

Want to skip the manual setup?

Our templates include a configuration tool. Enter your details once and download a ready-to-import workflow. View templates →

Configure Employee Offboarding Workflow

1. Go to https://tl-hr.com/configure/employee-offboarding-google-workspace
2. Enter the passcode (provided by your account)
3. Fill in the form:

Field	Description
Company name	Your company name
Google Workspace domain	e.g. acme.com
Gmail credential ID	The ID from the Gmail credential in n8n
Google Sheets credential ID	The ID from the Sheets credential in n8n
Google Service Account credential ID	The ID from the Service Account credential in n8n
n8n webhook URL	e.g. https://your-n8n-instance.com/webhook/employee-offboarding
Google Sheets ID	The ID from your Google Sheet URL (the long string in https://docs.google.com/spreadsheets/d/THIS-ID/edit)
Alert email	Email to receive error messages if the workflow fails
Default IT email	Email for IT services notifications
Default payroll email	Email for payroll/finance notifications

4. Click Download Workflow JSON to download the configured workflow
5. Click Download Apps Script to download the configured Google Apps Script file

---

Import the Apps Script into Google Forms

1. Go to your copied Google Form
2. Click the kebab menu button (three dots) on the top right and select Apps Script
3. In the new window, the Code.gs file should be empty
4. Open the downloaded employee-offboarding-google-workspace-appscript.gs file in a text editor
5. Copy and paste the entire contents into the empty Code.gs file
6. Select setup in the function dropdown and click the Run button
7. Approve the permissions when prompted
8. Click Deploy → New deployment
9. Click Deploy, then Authorize Access
10. Click Select all to allow the form access to your account

---

Import the Workflow into n8n

1. Create a new workflow in n8n
2. Click the kebab menu button (three dots) on the top right
3. Select Import from file
4. Select the downloaded employee-offboarding-google-workspace-configured.json file
5. Click Publish to set the workflow live

---

Ready to automate?

The full Employee Offboarding workflow includes the complete workflow, Apps Script, error handling, automatic retry, and the configuration tool. Setup takes 30-60 minutes if you follow this guide.

Test the Workflow

1. Submit a test offboarding entry through your Google Form
2. Verify that:
   • IT receives a notification
   • Payroll receives a notification
   • The manager receives a notification
   • The employee receives a notification
   • The Google account is suspended on the employee's last day
   • The offboarding is logged in the Google Sheet