domainwidedelegation.comStart free

Use cases → Admin and governance

Automatically reassign Workspace licences on user changes

Free up and reallocate Google Workspace licences by automating removal from leavers and assignment to new starters, using a delegated service account.

Who it is forIT operations teams managing fluctuating user headcount and tight licence pools.
APIsAdmin SDK
Typical scopesadmin.directory.user, admin.directory.license

The problem

Manually revoking and reassigning Workspace licences is error-prone and slow, especially in larger tenants or high-churn environments. Delays mean paying for unused seats or new users being blocked from key services.

How it works

  1. Monitor user lifecycle events to trigger licence changes.
  2. Use a delegated service account to impersonate an admin and call the Admin SDK's licence endpoints.
  3. Remove licences from departing users as soon as their status changes.
  4. Assign freed licences to incoming users, handling group or role-based requirements.
  5. Log every action with user, SKU, and timestamp for audit and troubleshooting.

What changes

Licence usage matches real headcount with minimal manual intervention. New users get access promptly, and unused seats are quickly recycled.

The trap in this one. The Admin SDK's licence removal and assignment operations are eventually consistent — a newly removed licence may not be available for reassignment for several minutes. If you assign immediately after removing, you can hit a quota error or silent failure, leaving the new user unlicensed and no clear error in the logs. Always implement a retry with backoff and check the effective seat count before assigning.

Watch it explained

“License Management Set Up Your Environment for Success” — Google Workspace on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Is it safe to bulk-remove and reassign licences in one script?

Not without handling propagation delays. Removing and immediately reassigning in a tight loop can race ahead of the backend, causing failed assignments or quota errors.

How should we audit licence changes?

Log every API call with the user, action, SKU, and timestamp. This allows you to reconstruct the sequence and diagnose any mismatches or failures.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Audit which third-party apps can read your mail

List every OAuth grant across the domain and find the retired tools still holding access.

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.