How to sign a user out of Google Workspace with GAM

One GAM7 command signs a user out of every web and device session. Here is the command, what Google says about how fast it takes effect, and why a district that uses single sign-on needs one more step.

A password was phished. A laptop was left signed in on a bus. A staff member left on bad terms. The account is still active, and you want every session it has open closed now, not the next time someone gets round to it.

The short answer

Start by listing the apps that hold access tokens for the account. Sign-out is about sessions, tokens are a separate list, and you will want to have seen it either way:

gam user alice@example.org show tokens

Then sign them out:

gam user alice@example.org signout

The GAM documentation describes it in one line: "Sign a user out of all web and device sessions and reset their sign-in cookies." (GAM wiki: Users - Signout) That is Google's own description of the underlying API call, almost word for word. (Directory API: users.signOut)

For a list of accounts, run it from a CSV file with a column named email:

gam csv accounts.csv gam user "~email" signout

It is not instant everywhere

Google says so directly: "It can take up to an hour to sign the user out of current Gmail sessions. The time for other applications can vary." (Manage a user's security settings)

So if the account is being misused right now, sign-out is the start, not the finish. Reset the password as well, so that a fresh sign-in cannot succeed, and work through the rest of what to check after an account is compromised.

If your district uses single sign-on

Many districts sign staff and students in to Google through a single sign-on provider. Google is plain about what that means here: "the user's SSO session may still allow access to their Google Account after resetting their sign-in cookies." (Manage a user's security settings)

In other words, signing someone out of Google does not sign them out of the service that signs them in to Google. End their session at your identity provider too, or disable them there, or they can walk straight back in.

Suspending already does this

If you are suspending the account anyway, you do not need a separate sign-out. From the same page: "If you suspended a user, you don't need to do this. Suspending a user resets their sign-in cookies."

Sign-out earns its place when the account has to stay active. The common case is a compromised account that you are about to hand back to its owner: sessions closed, password reset, owner signs in again, everything else intact.

Tokens are a separate list

The show tokens output from the first step lists the apps that have been granted access to the account. Signing out deals with sign-in sessions. Tokens are what apps use to reach the account's data, and Google manages them as a separate thing. Read the list before you move on, and look hard at anything you did not expect to see.

Sources

In ORINEX Workspace, sign-out is one step of the offboarding workflow, and the step is called "Sign out and revoke tokens" for a reason: the app tokens are cleared in the same pass as the sessions. What ORINEX Workspace does.