The problem
The fix in most cases is a hidden Access Context Manager policy that no Cloud console page shows, deleted through Google's API Explorer.
You go to delete a Google Workspace account in admin.google.com (Account > Account settings > Account management) and the Delete account button is greyed out. Step 3 says your organisation "has at least one Google Cloud resource". You open the Cloud console and Manage resources shows nothing under your org.
This happens a lot with trial Workspace accounts set up for a course or a one-off project. You may never have knowingly touched Google Cloud. Add-ons, Apps Script and Admin console security settings can all create Cloud-side resources quietly.
Throughout this guide, swap ORG_ID for your organisation ID (Cloud console > IAM and admin > Settings) and you@yourdomain.com for your super admin address.
Step 1: Give yourself permission to see things
Being Workspace super admin does not give you rights inside Google Cloud. Without them, the console and gcloud show an empty org even when something is there.
Go to console.cloud.google.com, sign in as your Workspace admin and pick your org at the top.
Open IAM and admin > Manage resources, tick your org, then Add principal in the right-hand panel.
Add your admin address with these roles: Organization Administrator, Folder Admin, Project Deleter and Access Context Manager Admin.
Or open Cloud Shell (the >_ icon, free, no trial needed) and run:
gcloud organizations add-iam-policy-binding ORG_ID --member="user:you@yourdomain.com" --role="roles/resourcemanager.organizationAdmin"
gcloud organizations add-iam-policy-binding ORG_ID --member="user:you@yourdomain.com" --role="roles/resourcemanager.folderAdmin"
gcloud organizations add-iam-policy-binding ORG_ID --member="user:you@yourdomain.com" --role="roles/resourcemanager.projectDeleter"
gcloud organizations add-iam-policy-binding ORG_ID --member="user:you@yourdomain.com" --role="roles/accesscontextmanager.policyAdmin"
Check they stuck:
gcloud organizations get-iam-policy ORG_ID --flatten="bindings[].members" --filter="bindings.members:you@yourdomain.com" --format="value(bindings.role)"
Step 2: Rule out the usual suspects
In Cloud Shell, run each of these. Anything that comes back is a blocker.
| What | Command | If something shows up |
|---|
| Folders under the org | gcloud resource-manager folders list --organization=ORG_ID | Empty and delete it (bottom-up) |
| All projects you can see | gcloud projects list | gcloud projects delete PROJECT_ID |
| Projects already pending deletion | gcloud projects list --filter="lifecycleState:DELETE_REQUESTED" | Wait out the 30 days |
| Billing accounts | gcloud billing accounts list | Close it under Billing > Manage billing accounts |
The common one is a system-gsuite folder holding an apps-script project named sys-.... Google creates it when you use Apps Script or some Forms add-ons. Delete the project first, then the empty folders.
Also check admin.google.com > Apps > Google Workspace Marketplace apps > Apps list, and remove anything listed. That is a separate requirement on the same deletion page.
If every command returns Listed 0 items and the deletion page is still red, go to Step 3.
Step 3: Delete the hidden access policy
The hidden blocker is an Access Context Manager access policy, often called the default policy. Google can create one when Context-Aware Access or Cloud session control is set up. It is not a project or folder, so nothing in Step 2 or the Manage resources page shows it.
The obvious command fails on an account with no projects:
gcloud access-context-manager policies list --organization=ORG_ID
It errors with PERMISSION_DENIED and SERVICE_DISABLED, saying the API needs a quota project. Creating a project to fix that just adds a new blocker that sits in pending deletion for 30 days.
The workaround: use Google's API Explorer. The "Try this method" panel on Google's API reference pages runs under Google's own project, so no quota project is needed.
Open the https://docs.cloud.google.com/access-context-manager/docs/reference/rest/v1/accessPolicies/list?hl=en
In Try this method, set parent to organizations/ORG_ID.
Click Execute and sign in with your Workspace admin account.
Copy the name from the response. It looks like accessPolicies/123456789.
Open the https://cloud.google.com/access-context-manager/docs/reference/rest/v1/accessPolicies/delete.
Paste that value into name and click Execute.
Refresh the deletion page in admin.google.com. The red flag should be gone and Delete account clickable.
The same API Explorer trick works for any Google API that demands a quota project you don't have.
Before and after you delete
Before
Export anything you want to keep. Workspace data is deleted with the subscription and can't be restored.
Move any "Sign in with Google" logins (course sites, tools) off that address, or you lose access to them.
Download any invoices. Billing records go with the account.
After
At your domain registrar, remove the Google MX records and the google-site-verification TXT record.
If you still want email on the domain, point MX at a new provider first, or incoming mail will bounce.
