Maciej Urbański

Work · Identity

Google Workspace migration and HR-driven automation

Led a multi-branch migration to Google Workspace and automated account and security enrollment through HR-driven scripts—completed with zero downtime across multi-site operations.

My role Program / tech lead for cutover and hypercare; authored HR-driven provisioning automation with support/ops.

Stack Google Workspace · Python · PowerShell · HR event signals · identity lifecycle runbooks

Context
A multi-branch organization (plus HQ functions) needed a full workplace platform migration and more reliable user lifecycle management—without interrupting café and HQ operations. Stakeholders: HR, support, branch managers, leadership. Constraint: cutover had to be zero-downtime for day-to-day work; joiner/mover/leaver could not stay ad-hoc admin tickets forever.
Intervention

Led the Google Workspace migration and automated account plus security enrollment using HR-driven scripts so identity followed HR signals.

Phase 1 — Discovery & cutover design

Inventoried mail, drive, identity, and device touchpoints. Designed a phased cutover with rollback points and hypercare windows that respected café operating hours.

Phase 2 — Migration execution

Executed the Workspace migration with support/ops coordination so sites kept working through the change. Targeted zero downtime as a hard success criterion—not a slogan.

Phase 3 — HR-driven automation

Automated account and security enrollment with Python and PowerShell scripts driven by HR events, so joiner/mover/leaver became a scripted path instead of tribal knowledge.

Risks & how they were handled
  • Cutover outage → phased plan, hypercare, and café-hour awareness.
  • Orphaned accounts → HR-driven lifecycle as the standard path post-migration.
  • Support overload → runbooks and shared ownership with the support team.
What I'd do differently
  • Publish a one-page “day-of cutover” checklist even earlier for branch managers.
  • Measure enrollment time per joiner for a baseline week before/after automation.
Outcome
Before: multi-branch identity administration depended on ad-hoc admin work per joiner/mover/leaver. After: Google Workspace migration completed with zero downtime across multi-site operations, and HR-driven Python/PowerShell scripts automate account and security enrollment—so routine provisioning is a scripted follow-through of HR signals rather than a manual ticket each time (est. minutes of scripted enrollment vs. a longer ad-hoc admin pass per person).

System map

HR event

join / leave / move

Scripted runbooks

Python · PowerShell

Workspace identity APIs

accounts

Automation

Security enrollment

standard path

Multi-site users

zero downtime

What it does

Cuts over without downtime

Provisions from HR events, not tickets

Keeps enrollment on a standard path

HR-driven identity — accounts follow events, not a ticket per person.

What shipped

  • Zero-downtime cutover Google Workspace migration across multi-site operations without an outage window.
  • HR-driven provisioning Account and security enrollment scripts keyed off HR events.
  • Runbooks Cutover plan and identity lifecycle notes (detail under NDA).

Stack Google Workspace Python PowerShell HR signals runbooks

← Privacy-first kids apps Next: POS / Deliverect →