TL;DR

• Slack, Zoom and Notion are not managed by Google Workspace’s admin console by default, so offboarding a Google Workspace user does not automatically remove their access to these tools.

• All three platforms offer SSO and SCIM-based provisioning, but only on upper-tier plans (Notion SCIM is Enterprise only), so automated deprovisioning is possible only if someone configures and maintains that connection.

• Poorly managed offboarding leaves open insider-access risk, and unused SaaS licenses quietly drain company budgets.

• A written offboarding checklist that explicitly lists every non-Google app closes the most common gap in employee lifecycle management.

• A SaaS management platform purpose-built for Google Workspace can remove Google Workspace access automatically and turn every other app you track into a guided task for its owner.

Why Doesn’t Google Workspace Offboarding Cover Slack, Zoom and Notion?

Google Workspace’s admin console controls identity and access for apps that live inside its ecosystem: Gmail, Drive, Calendar and connected Google services. Slack, Zoom and Notion are independent platforms with their own user databases, billing systems and permission structures. When an admin suspends a Google Workspace account, that action does not reach into Slack’s workspace membership list or Notion’s shared workspace roster unless a specific integration has been built and maintained to do so.

This is a structural gap, not a bug. Each of these tools was designed to work as a standalone SaaS product first, with Google Workspace integration added as a convenience layer for login and file sharing. Slack, for instance, can be set up for automatic provisioning through the Google Admin console, but an admin has to configure deprovisioning there for it to take effect. If that configuration was never set up, or was set up by someone who has since left the company, offboarding falls back to a manual process that someone has to remember to run.

Why Do These Apps Get Missed During Offboarding?

These apps get missed largely because they are invisible during the parts of offboarding people actually think about. A typical offboarding checklist template centers on the obvious: disable the corporate email account, collect the laptop, revoke building access. Slack, Zoom and Notion rarely make that list unless someone has been burned by forgetting them before.

The exposure can be wide. Most employees use many SaaS applications daily for core work, and many of them sit outside the Google Workspace ecosystem. If an offboarding process only touches Google Workspace, it leaves the rest of that person’s digital footprint untouched. Multiply that gap across every departure a growing company has in a year, and the number of dangling accounts adds up quickly.

This is where the risk becomes concrete. A former employee with a live Zoom license, for example, could still host meetings under the company’s brand if they can still sign in. A departed contractor with lingering Notion access could still view internal roadmaps or compensation bands. Neither requires malicious intent to become a problem. Access that should have been closed simply stays open.

What Can Each Platform Actually Do to Support Deprovisioning?

Understanding what each tool is capable of matters more than assuming it already works automatically. Slack, Zoom and Notion all offer SAML-based Single Sign-On and SCIM-based provisioning, which means automated provisioning and deprovisioning is achievable on all three. Availability depends on your plan, and none of the three offers SCIM on its entry paid plans: it is upper-tier only, and Notion SCIM is Enterprise only, so check what yours includes. The capability exists. The question is whether anyone has wired it up correctly and kept it maintained.

The Zoom row is worth sitting with. Zoom’s Google Workspace add-on handles calendar and email scheduling, not authentication or user provisioning. A scheduling integration that works perfectly says nothing about whether a departed employee’s license is still active, and an operator who installed the add-on once can easily assume the opposite.

Why Do Compliance Frameworks Treat This as a Real Requirement, Not a Nice-to-Have?

Framing deprovisioning as a courtesy rather than a control misses what auditors actually check. Frameworks such as SOC 2 and ISO 27001 expect access to be removed promptly when someone leaves, and that expectation covers third-party SaaS applications that hold company data. An auditor reviewing SOC 2 evidence will commonly ask for proof that a departed employee’s access was revoked across the systems that touched company data, not just the ones on the primary identity provider.

For a company pursuing SOC 2 compliance for the first time, this is often the moment Slack, Zoom and Notion get discovered as gaps. The irony is that fixing this after an audit finding is more disruptive than building the checklist correctly the first time.

What Does a Complete Offboarding Checklist Actually Look Like?

A workable offboarding checklist template treats every SaaS app with company data as a required line item, not an optional one. At minimum, it should include:

• Google Workspace: suspend the account, transfer Drive ownership, set up email forwarding if needed.

• Slack: deactivate the user, review and reassign ownership of any channels or workflows they administered.

• Zoom: revoke the license, transfer ownership of scheduled meetings and cloud recordings.

• Notion: remove workspace membership, audit any pages shared externally under their account.

• Shadow IT discovery: check for any app the employee connected using their work email that was never centrally provisioned in the first place.

That last point matters as much as the first four. Shadow IT discovery exists precisely because employees sign up for tools using a company email address without anyone in finance or IT ever approving or tracking the purchase. An offboarding checklist that only covers known, sanctioned apps will always miss these.

How Should Operators Think About Fixing This Without Hiring an IT Team?

The honest answer is that manual checklists work until they don’t. A 5-person startup can get away with a shared document and institutional memory. A 50-person company with hiring velocity, regional offices or contractor turnover cannot rely on someone remembering to log into 4 different admin consoles every time a person leaves.

This is the specific problem a SaaS management platform is built to solve. ShiftControl is made for Google Workspace. When someone leaves, Google Workspace access is removed automatically, and everything else runs as a guided task list for the app owner. Work Items turns every joiner, mover and leaver into a ready-made task list, generated automatically the moment your directory changes, so Slack, Zoom and Notion can show up as tasks when they’re tracked in ShiftControl, each one owned by someone instead of a step someone has to remember.

ShiftControl also tracks SaaS spend and contract-renewal dates once app cost data is entered. SaaS licenses that go unused after an employee departs represent both a security gap and an ongoing financial drain. A Zoom license sitting idle under a departed employee’s name needs attention on both fronts.

Frequently Asked Questions

Does suspending a Google Workspace account also remove Slack or Zoom access?

No. Suspending a Google Workspace account only affects Google-native services. Slack, Zoom and Notion each require a separate deprovisioning action unless an admin has configured automated SCIM or SSO-based deprovisioning that connects to those platforms.

What is the biggest risk of forgetting to revoke Notion access?

A former employee or anyone who later gains access to their old credentials could still view internal documents, roadmaps or shared databases. SSO does not remove a person’s Notion workspace membership, so membership and sessions stay live until someone removes them.

Why do companies miss these apps during offboarding?

These apps rarely appear on a standard offboarding checklist, and a missed app stays active until someone notices.

Is SCIM the same as SSO?

No. SSO (via SAML) controls how a user logs in; SCIM controls how user accounts are created, updated and removed across connected systems. Both are needed for full automated deprovisioning.

Do compliance frameworks actually check for this?

Yes. Frameworks such as SOC 2 and ISO 27001 expect access to be removed when someone leaves, and auditors commonly ask for evidence that it was, including for third-party SaaS apps.

Can a small company without an IT team manage this on its own?

Yes, with the right tooling. A platform built for Google Workspace can remove Google Workspace access automatically and turn the remaining apps into a guided task list, without requiring a dedicated IT hire.

What’s the first step to fixing this at a growing company?

Start by writing down every SaaS app with access to company data, confirm which ones support SCIM or SSO on your plan and build those into a single offboarding checklist that triggers from one source of truth rather than relying on memory.

About ShiftControl

ShiftControl is an IT operations and SaaS management platform purpose-built for Google Workspace, giving small and growing businesses the access control, spend visibility and incident response capabilities of a much larger company, without the complexity or cost. It is designed for the non-technical operator, no IT team required, and sets up in as little as 10 minutes with Google Workspace admin single sign-on. Cyber incident response (IR-1, via Blackpanda) is included in every subscription rather than sold as an add-on. Pricing is $10 per user per month with everything included, and startups get $2 per user for the first 10 seats for the first year.

If your offboarding process still depends on someone remembering to check 4 different admin consoles, it’s worth seeing what a connected approach looks like. Start a 14-day free trial (no credit card required) or book a demo.