TL;DR

• Google Workspace cannot merge two accounts directly. You either migrate data manually or use Google’s Domain Transfer service, which is delivered through Google’s professional services organization rather than self-serve.

• On the migration path Google requires you to cancel the source subscription and delete all but one of your accounts before the domain can be added to the primary one. Google states the deletion is permanent and the account cannot be restored, and the Gmail, Drive and Calendar data inside it goes too, so migrate and verify everything first.

• Post-acquisition domain consolidation for email and collaboration tools typically takes several weeks; full domain and SEO stabilization can take several months or longer.

• The biggest security exposure isn’t the migration tooling. It’s orphaned accounts, mismatched sharing permissions and uneven MFA enforcement across the two environments during the transition.

• Compliance frameworks like GDPR, HIPAA and SOC 2 all require documented access controls and audit trails throughout the merge, not just at the end.

About the Author: ShiftControl was built by Dan Gericke and Julien Monguillot, co-founders who previously ran IT and global SaaS operations at ExpressVPN. ShiftControl now helps founders and operators manage Google Workspace access, SaaS spend and security for organizations that don’t have (and don’t want to hire) a dedicated IT team.

Can You Actually Merge Two Google Workspace Domains?

No, not in the way most people expect. Google Workspace does not support directly combining two separate accounts into one. Each Workspace tenant is its own isolated environment with its own users, admin console and billing. There is no “merge” button.

What you can do falls into two paths:

• Manual migration: Use a supported migration tool or a third-party migration service to move mail, files, calendars and contacts from the acquired company’s domain into the primary account. This is the more common route for smaller acquisitions.

• Domain Transfer service: Google’s official offering, delivered through its professional services organization rather than self-serve. It converts the acquired company’s primary domain into a secondary domain, moves eligible secondary domains and entities into a transfer root organizational unit inside the destination environment and leaves a placeholder domain behind in the source environment.

The migration path carries a hard constraint worth planning around early. Google’s own “Merge domains from separate accounts” Help article is explicit: you cancel the source subscription and delete all but one of your accounts. It is equally explicit about what that costs you: once an account is deleted from the Admin console the deletion is permanent, the account cannot be restored, and the Gmail, Drive and Calendar data inside it goes with it. Complete and verify your migration before you go near that step. You cannot run both tenants indefinitely and expect a clean handoff. Someone has to decide, on a timeline, when the old tenant goes away, and that decision has direct consequences for access.

Why Does This Take So Long?

Because migration tools operate under strict limits, and because “done” means more than data moved. Gmail API query quotas throttle how fast mailboxes can be migrated, so even a well-planned project has a floor on how quickly it can execute. Layer on calendar reconciliation, shared drive permissions, group memberships and third-party app connections, and the timeline stretches further.

Email and collaboration tool consolidation typically unfolds over several weeks post-acquisition. If the acquisition also involves a website or public-facing domain change, full SEO and domain stabilization can take several months or longer before organic traffic and search visibility fully recover.

That’s a long window for two sets of security policies, two sets of app permissions and two employee rosters to coexist. Most of the operational pain in a domain merger doesn’t come from the migration mechanics. It comes from what happens to access during the weeks in between.

What Actually Goes Wrong During the Transition?

Building on the timeline above, the harder problem isn’t moving the data. It’s controlling who can see it while both environments are still live. Documented risks during Google Workspace domain consolidation cluster around a few repeatable patterns:

• Orphaned accounts: Employees who left the acquired company, or whose roles changed, but whose accounts and permissions were never revoked in the source tenant. These accounts often retain access long after anyone is tracking them.

• Misconfigured sharing permissions: Files and folders shared broadly in the acquired company’s domain get pulled into the primary tenant with the same broad permissions intact, exposing data across teams that were never meant to see it.

• Inconsistent MFA enforcement: If the acquired company had weaker or optional multi-factor authentication, that gap becomes an entry point for credential harvesting the moment the two environments start connecting.

Think of it like combining two households into one before you’ve agreed on who has keys to which rooms. Even if the move itself goes smoothly, you end up with spare keys nobody remembers handing out, and doors left unlocked because nobody double-checked. The migration is the move. Access governance is deciding who gets which keys, and doing it before the boxes are even unpacked.

This is also the exact moment when a shadow IT discovery exercise pays off. Acquired companies almost always bring app subscriptions, browser extensions and third-party integrations that never went through a security review. Running discovery early, before consolidation, tells you what you’re actually inheriting instead of finding out six months later.

How Do Compliance Requirements Change During a Merger?

Compliance obligations don’t pause for a migration timeline, and in some cases they get stricter. If either company handles EU personal data, GDPR requires a lawful basis for processing it throughout the transition, plus access controls and records of processing. If protected health information is in scope, HIPAA mandates access controls and audit logs that need to hold up even while systems are in flux. And if you’re pursuing or maintaining SOC 2 compliance, auditors expect continuous monitoring, least-privilege access and documented controls, which is difficult to demonstrate if two domains are running on two different policy sets.

A related but distinct question is who owns this during the merger window. In a large enterprise, this sits with a dedicated IT and security team. In most acquisitions involving small or mid-sized companies, it lands on a founder, COO or CTO who is already stretched across the rest of the deal.

How Do You Run a Google Workspace Security Audit Before You Merge?

Before you touch migration tooling, you need an honest inventory of what you’re merging. A Google Workspace security audit at this stage should answer three questions: who has access to what, which third-party apps are connected to each domain and where MFA and password policies diverge between the two environments.

This is where an operator-led approach, rather than a big IT project, actually works better. You don’t need a six-week discovery phase to get these answers. ShiftControl is purpose-built for Google Workspace and made for operators, not IT teams. You need Workspace admin rights; you do not need IT expertise. ShiftControl connects directly to Google Workspace to surface exactly this picture: which apps have access to company data, what scopes they hold and where permissions look risky, all from a single dashboard rather than four separate tools for provisioning, spend, permissions and incident response.

That consolidated view matters twice during an acquisition: once to audit the acquired company’s environment before you commit to a timeline, and again to confirm the merged environment is clean once the transfer is complete.

How Should You Handle Provisioning and De-Provisioning During the Merge?

Directly following from the audit, the next operational task is deciding, role by role, who keeps access, who loses it and when. Manually tracking this across two domains in a spreadsheet is exactly how orphaned accounts happen. ShiftControl’s Smart Provisioning syncs with HRIS systems like HiBob, BambooHR and Deel, so when an acquired employee’s status changes, their Google Workspace access changes with it. Apps that support SCIM update automatically; the rest arrive as a guided task list for the app owner, rather than depending on someone remembering during a busy integration period.

Setup can take as little as 10 minutes through a Google Workspace admin login, which matters when you want visibility fast rather than a multi-week implementation project on top of an acquisition.

What Happens If Something Goes Wrong Mid-Merger?

Two domains in transition, with inconsistent MFA and unaudited permissions, is a higher-risk window by definition. Smaller and mid-sized organizations face heightened exposure to ransomware and cyberattacks because they typically have fewer dedicated security resources to fall back on. If an incident happens during a merger, response speed matters more, not less, because you’re also trying to figure out which domain the exposure originated in.

ShiftControl includes cyber incident response, IR-1, via partnership with Blackpanda, as part of the subscription rather than as a paid add-on. That includes 24/7 access to incident responders, one annual incident response credit covering the full organization and containment and initial investigation support.

Frequently Asked Questions

Can I merge two Google Workspace accounts myself without Google’s help?

Yes, for smaller migrations, using a supported migration tool to move mail, files and calendars. Check which tools Google currently supports before you commit to one. Larger mergers typically use Google’s Domain Transfer service, which is delivered through Google’s professional services organization rather than self-serve.

Do I need to delete the old Workspace tenant?

On the migration path, yes. Google’s “Merge domains from separate accounts” guidance is to cancel the source subscription and delete all but one account, and it states plainly that the deletion is permanent and the account cannot be restored. Everything inside it goes with it: mail, files, calendars. Complete and verify your migration first.

How long does a Google Workspace domain merger take?

Email and collaboration tool consolidation typically takes several weeks. If a public website or SEO domain is also changing, full stabilization can take several months or longer.

What’s the biggest security risk during a domain merger?

Orphaned accounts, misconfigured sharing permissions and inconsistent MFA enforcement between the two environments.

Do compliance requirements still apply during the transition period?

Yes. GDPR, HIPAA and SOC 2 all require continuous access controls and audit trails, not just a clean end state.

What is shadow IT discovery, and why does it matter for a merger?

Shadow IT discovery identifies apps and integrations connected to your Google Workspace domain that weren’t formally approved. It matters during a merger because you’re inheriting the acquired company’s unreviewed app footprint along with its employees.

Can a small company manage this without hiring dedicated IT staff?

Yes. Platforms purpose-built for Google Workspace, like ShiftControl, are designed specifically so founders, COOs and CTOs can manage provisioning, permissions and SaaS spend management without a dedicated IT hire.

About ShiftControl

ShiftControl is an operations platform purpose-built for Google Workspace, giving small and growing companies the access control, SaaS spend visibility and incident response capability of a much larger organization, without requiring an IT team to run it. Founded by operators who ran IT and SaaS operations at ExpressVPN, ShiftControl combines provisioning and access, SaaS spend management, app-permission visibility and incident response into one platform instead of four disconnected tools and a spreadsheet. Pricing is public: $10 per user per month with everything included, and 80% off your first 10 seats for the first year if you’re a startup. Downloadable, audit-ready access reports are included as standard rather than gated behind premium tiers.

If you’re navigating a Google Workspace merger and want a clear picture of access, permissions and risk before you consolidate domains, see where things stand at shiftcontrol.io before the migration starts, or start a 14-day free trial with no credit card required.