[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2024-07-11 (世界標準時間)。"],[[["\u003cp\u003eThis document outlines the process of sanitizing Gmail accounts to remove corporate email addresses used as alternate addresses, especially in cases where companies haven't adopted Cloud Identity or Google Workspace.\u003c/p\u003e\n"],["\u003cp\u003eSanitizing Gmail accounts helps mitigate security risks by preventing the use of corporate email addresses for potentially unauthorized access through social engineering.\u003c/p\u003e\n"],["\u003cp\u003eThere are two main scenarios for sanitizing: encouraging the user to switch to a managed account within Cloud Identity or Google Workspace, or simply forcing the account to relinquish its corporate email address.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves either creating a managed user account with the corporate email address or creating and immediately deleting such an account to prompt the Gmail account owner to disassociate and rename the account.\u003c/p\u003e\n"],["\u003cp\u003eBest practices for preventing future issues include proactively provisioning user accounts in Cloud Identity or Google Workspace and implementing policies to restrict access by domain.\u003c/p\u003e\n"]]],[],null,["# Sanitize Gmail accounts\n\nThis document describes how to *sanitize* existing Gmail accounts by\ndeliberately removing any corporate email addresses from them. If your company\nhasn't been using\n[Cloud Identity](/identity)\nor\n[Google Workspace](https://gsuite.google.com/),\nit's possible that some of your employees have been using Gmail\naccounts to access Google services. Some of these Gmail accounts might\nuse a corporate email address such as `alice@example.com` as an\n[alternate email address](https://support.google.com/accounts/answer/176347).\n\nConsider sanitizing a Gmail account if either of the following\nconditions is true:\n\n- You want the owner of the Gmail account to switch to a [managed user account](/architecture/identity/overview-google-authentication#managed_user_account).\n- You want the Gmail account to stop using a corporate email address as an alternate address. This might be because the account belongs to a former employee or because you don't recognize the owner of the account.\n\nRemoving the corporate email address from a Gmail account can mitigate\na social engineering risk: if a Gmail account uses a seemingly\ntrustworthy email address\nlike `alice@example.com` as an alternate address, then the owner of the account\nmight be able to convince employees or business partners to grant them access to\nresources they shouldn't be allowed to access.\n\nBefore you begin\n----------------\n\nTo sanitize a Gmail account, you must meet all of the following\nprerequisites:\n\n- You have [identified a suitable onboarding plan](/architecture/identity/assessing-onboarding-plans) and have completed all activities that your plan defines as prerequisites for consolidating your existing user accounts.\n- You have created a [Cloud Identity or Google Workspace account](/architecture/identity/overview-google-authentication#cloud_identity_or_g_suite_account).\n\nEach Gmail account that you plan to sanitize must meet the following\ncriteria:\n\n- One of the [alternate email addresses](https://support.google.com/accounts/answer/176347) of the Gmail account corresponds to one of the domains that you've added to your Cloud Identity or Google Workspace account. Both primary and secondary domains qualify, but alias domains are not supported.\n\n| **Note:** The [transfer tool for unmanaged users](https://admin.google.com/ac/unmanaged) doesn't find Gmail users, regardless of the alternate email addresses they use.\n\nProcess\n-------\n\nSanitizing Gmail accounts works like\n[migrating consumer accounts](/architecture/identity/migrating-consumer-accounts),\nbut it is based on the idea that you deliberately create a conflicting\naccount.\n\nThe following diagram illustrates the process. Rectangular boxes on the\n**Administrator** side denote actions that a Cloud Identity or\nGoogle Workspace administrator takes; rectangular boxes on the **User\naccount owner** side denote actions that only the owner of a consumer account\ncan perform.\n\nThe sequence of steps differs slightly depending on whether you want the owner\nof the Gmail account to switch to a managed user account or whether you\nsimply want the account to give up its corporate email address.\n\n### Encourage a switch to a managed account\n\nIf you want a user to switch to a managed account, create a user account for\nthat user in Cloud Identity or Google Workspace. For the primary\nemail address, use the email address that's used as an alternate email address\nby the Gmail account. For example, if the Gmail user `bob@gmail.com`\nhas specified `bob@example.com` as an alternate email address, use\n`bob@example.com` as the primary email address for the Cloud Identity or\nGoogle Workspace user.\n\nThe owner of the affected account has two ways to sign in---by using the\nGmail address or by using the corporate email address. If the owner\nsigns in by using the Gmail address, they see the following message,\nindicating that the corporate email address has been disassociated from the user\naccount:\n\nThe account owner sees this message only once. If the owner instead signs in by\nusing the corporate email address, they see a ballot screen:\n\nIf they select **Organizational Google Workspace account** , they\nmust authenticate using the credentials of the newly created user account\nin Cloud Identity or Google Workspace. If they use\n[an external IdP](/architecture/identity/reference-architectures#using_an_external_idp),\nthis process involves single sign-on. Because the user account in\nCloud Identity or Google Workspace is new, none of the Gmail\naccount's data is transferred.\n\nIf they select **Individual Google account**, they continue with their\nGmail account, but they see the following message indicating that the\ncorporate email address is being disassociated from the user account:\n\nAfter confirming, they are shown another message:\n\n### Force an account to give up its corporate email address\n\nYou can force an account to give up its corporate email address as follows:\n\n1. Create a user account in Cloud Identity or Google Workspace that has the corresponding corporate email address. Because you don't want the managed user account to ever be used, assign a random password.\n2. Delete the user account that you just created.\n\nBy creating a conflicting account and immediately deleting the managed account,\nyou leave the consumer account in a state where the owner has to rename the\naccount.\n\nThe owner of the affected account has two ways to sign in---by using the Gmail\naddress or by using the corporate email address:\n\n- If the owner signs in by using the Gmail address, they see the\n following message, indicating that the corporate email address has been\n disassociated from the user account:\n\n- If they instead sign in by using the corporate email address, they see\n the following message:\n\n After confirming, they are shown another message:\n\n All configuration and data that was created by using this consumer account\n is unaffected by the renaming process. But for subsequent attempts to sign\n in, the user must use the Gmail address because the corporate\n address is no longer associated with the user account.\n\nBest practices\n--------------\n\nWe recommend the following best practices when you are sanitizing Gmail\naccounts:\n\n- Prevent other users from assigning a corporate email address to their Gmail accounts by [proactively provisioning user accounts to Cloud Identity or Google Workspace](/architecture/identity/best-practices-for-federating).\n- Prevent new Gmail accounts from being granted access to\n Google Cloud resources by using an organizational policy to\n [restrict identities by domain](/resource-manager/docs/organization-policy/restricting-domains).\n\n- Prevent Gmail accounts from being given access to Google Marketing Platform by\n using a\n [policy that restricts sharing by domain](https://support.google.com/marketingplatform/answer/9014058).\n\nWhat's next\n-----------\n\n- Review how you can [assess existing user accounts](/architecture/identity/assessing-existing-user-accounts).\n- Learn how to [evict unwanted consumer accounts](/architecture/identity/evicting-consumer-accounts)."]]
