domainwidedelegation.comStart free

Use cases → Admin and governance

Bulk add and remove user email aliases

Automate the process of managing hundreds of user aliases across a domain using a delegated service account and the Admin SDK.

Who it is forIT operations teams managing email migrations, rebrands, or large-scale onboarding/offboarding.
APIsAdmin SDK
Typical scopesadmin.directory.user.alias

The problem

Adding or removing aliases one at a time through the admin console is tedious and error-prone at scale. Bulk changes are needed when merging domains, onboarding acquired teams, or rolling out new email naming schemes.

How it works

  1. Prepare a list of users and their required alias changes (additions and removals).
  2. Use a delegated service account with the admin.directory.user.alias scope.
  3. Iterate through the list, calling the Admin SDK to add or remove each alias.
  4. Log each operation and verify by re-fetching aliases for affected users.

What changes

Alias changes are applied in minutes rather than hours, with a verifiable audit trail and no manual intervention.

The trap in this one. The Admin SDK's alias add and remove endpoints are eventually consistent: changes can take up to several minutes to propagate. If you attempt to add and then immediately remove (or vice versa) the same alias within a single run, you will receive a 404 or 409 error, as the state has not yet settled. This breaks idempotent scripts that expect immediate consistency.

Watch it explained

“Bulk Create Google Workspace Users Aliases with GW Manager” — GW Manager on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

How many aliases can a user have?

Each user can have up to 30 aliases; exceeding this will result in a 403 error from the API.

Do alias changes affect mail delivery instantly?

Not always. While most changes are fast, allow up to 24 hours for full propagation, especially to external senders.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Audit which third-party apps can read your mail

List every OAuth grant across the domain and find the retired tools still holding access.

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.