The Google Admin console can do everything Mekovault does in Google Workspace: create, suspend, transfer, delete. What it cannot do is find out that someone joined or left, do it on the right day and at the right time without an administrator remembering, ask the manager, look at the other platforms or leave readable evidence. Mekovault does not replace the console: it operates it for you.
Updated on October 11, 2026 · 6 min read · Mekovault
| Situation | By hand in the console | With Mekovault |
|---|---|---|
| Someone starts on Monday | Someone finds out (sometimes that same Monday), creates the account, guesses groups and license | HR or your payroll system (Buk and Talana today) records the hire; the account is created first thing Monday with the groups, org unit and license of the department |
| Someone leaves Friday at 6:00 p.m. | The admin suspends the account when they can; sometimes on Monday | Blocked Friday at 6:00 p.m., with email forwarded and an auto-reply |
| Where their files go | The admin decides, or nobody does | The manager decides by email; two reminders if there is no answer |
| The license | Stays assigned to the suspended account; you find out on the invoice | Flagged for release; a notice before the renewal with how many to reduce |
| Delete after 30 days | If someone remembers | Scheduled, with advance notice and the option to undo |
| Slack, Zoom, Figma | Another console, another day, another person | In the same request: the connected ones are closed and the rest become a task with an owner |
| Apps authorized with the account | User by user, if someone knows where to look | Weekly review of the whole company, risk, the manager’s decision |
| The person comes back for 5 days | Reactivate, remember to suspend again | Temporary reactivation with the manager’s approval; it blocks itself when it expires |
| The auditor asks what was done | Console log, technical, mixed in with everything else | Readable audit: who requested, who approved, what was done, when; 365 days |
| Who can do it | Whoever has the admin password | The roles you define: HR requests, the manager decides, Support resolves |
Everything that is exceptional: changing security settings, creating new organizational units, migrating domains, defining device policies. Mekovault does not touch that. It handles the repetitive part that happens every time someone joins, changes or leaves, which is where licenses and access get lost.
You connect Google Workspace with a ten-minute guide. From then on, hires and departures are requested in Mekovault (or arrive from your payroll system, Buk and Talana today; if yours is ADP, Gusto or BambooHR, HR records them in Mekovault and the rest runs the same) and the console is kept for the exceptional. If someone changes something by hand, Mekovault sees it on the next sync. How each account is governed, in Account governance; what each platform does, in Platforms.
It needs a service account with permissions to manage users, groups, licenses and authorized applications. It does not read email or files. Every use of that credential is audited.
You can. This guide works as a checklist either way. The difference shows up when the person doing it by hand is on vacation, leaves, or forgets to delete the account after 30 days.
Yes. Mekovault picks up whatever you change in the console on its next sync. Ideally, hires and departures go through Mekovault so they carry a date, a decision and evidence.