7. Complete post-transfer tasks

The domain transfer team executes post-transfer audits. These steps are needed to ensure consistency between the pre and post-transfer environments.

This process takes 5–7 days after the production transfer ends. You’re notified when it’s complete. During this audit period, destination environment admins can resume all normal operations (including suspending and renaming users) but they must not remove any users including both transfer users or existing destination users.

Source environment admins need to work through these steps once the production transfer process is complete.

1. Check that content left in the source environment (policies and settings, reporting data, etc.) is still accessible.

   Note that Google Vault artifacts might become inaccessible in the source environment post-transfer. Learn more

2. Start preparing the source environment for decommission, including the removal of extra licenses (to avoid billing issues).
3. Once complete, delete the source environment. Google does not do this automatically.

Destination environment admins must work through these tasks once the production transfer process is complete. Not all tasks are applicable to your setup. 

1. Review all actions taken during the production transfer process—These actions can be found in the admin reports in the Google Admin console. Within the reports, all transfer actions are attributed to the "Google Workspace Domain Transfer Admin" or the "dasher-entity-transfer" service account. Learn more
2. Reassign admin roles to source environment admins—Source admins transfer over as regular users and do not have their roles reassigned automatically. Destination environment admins have to manually reassign admin roles for the source environment admins.
3. Resolve Google Drive template visibility issues in the template gallery—There’s a known issue where Drive templates generated from files inside shared drives do not show up in the destination environment’s template gallery post transfer.

   To resolve this issue, end users must reset link sharing by stopping all file sharing and then share it again. Learn more

   Once complete, resubmit the file to the template gallery. Learn more

4. Update dynamic groups—Manually update all transferred dynamic groups. You can update the query by making a small change that doesn’t alter the outcome, such as adding or removing a space.

   You must have dynamic groups on your destination domain to complete this task. Without dynamic groups, group membership is locked. You can’t edit or update the membership list. 

5. Audit and clean up—There are multiple audits and clean-up steps you might need to address:

   • Rename any transfer users, if needed. Learn more
   • Merge duplicate users, if needed. Learn more
   • Rename any transfer groups, if needed. Learn more
   • Review all admin settings and modify any that need changes based on the addition of the transfer users and the transfer organizational units.
   • For calendar resources, merge buildings together by moving resources from one building to the other.
6. Set up DomainKeys Identified Mail (DKIM) for the transfer domains—Establish DKIM for all transfer domains, as needed. If a transfer domain used DKIM before the transfer, make sure you remove the old Domain Name System (DNS) record before adding the new one. Learn more
7. Communicate actions end users need to take—Inform transfer users of the potential impact of the migration to their file sharing settings (especially link sharing), and recommend they review and reshare files as needed.
8. Restore Google Vault artifacts and set up proper retention rules—There are multiple Vault items you need to address.
   Important: These steps must be done before you remove the Vault retention rules created by the domain transfer process to avoid any unexpected and irreversible data loss.
   1. Recreate matters and holds as needed. Learn more
   2. Configure the proper Vault retention rules that apply to the transfer root organizational unit and its child organizational units.
   3. (Optional) Remove the Vault retention rules created by the domain transfer process in the destination environment. These rules were originally set up in the pretransfer tasks.
9. Update provisioning systems and third-party identity providers—Ensure your transfer users can authenticate on their transfer domain by renaming the users with the destination's primary domain or updating your third-party identity provider.

   Update your automated provisioning systems to ensure that the transfer users aren't automatically suspended or deleted.

10. Add users to Google Voice—You can re-enroll transferred users to Voice. For details, go to Set up Voice for your organization.

11. Reestablish Google Chrome profiles:
    • Managed devices—You need to manually re-enroll Chrome profiles on any managed device because the profiles remain associated with the source environment. For details, go to Enroll cloud-managed Chrome browsers.
    • Non-managed devices—On non-managed devices, re-create the Chrome profile. This profile uses the policies set up in the destination environment. You might also need to set policies for enrolled Chrome Browsers.
12. Re-enroll work devices—If you don't have an automatic re-enrollment policy, you can re-enroll work devices that were deleted. For details, go to Manage devices with Google endpoint management.
13. Update Looker Studio dashboards—If a report or data source was shared with your organization before the transfer, it might continue to be shared with the source domain after a transfer. To resolve this issue, after the transfer, change the sharing settings to Anyone who has the link, then set it to Anyone in the destination subdomain.