Google Workspace Automation: Apps Script vs GAM vs Admin SDK vs No-Code Tools

Google Workspace automation covers two jobs. Workflow automation moves everyday work along: routing emails, filling sheets, sending reminders. Admin and lifecycle automation creates, changes and removes users, groups and access. Some tools provide ready-made lifecycle policies; others let you build the workflow through code or integrations. Pick the job first, then decide how much you want to build.

Patronum covers the admin side of Google Workspace automation without code: policies run hourly against an OU, Group or Directory condition to provision, update and offboard users.

One new sales hire, three ways

Say Jordan joins the sales team. Jordan needs an account in the Sales OU, membership in the sales Google Group, access to the team’s shared folders, and the sales email signature. Here’s how each route handles it:

• GAM7: an admin runs a few commands to create the user, set the OU and add the group, or schedules a script that does.
• Apps Script: a script using the Admin SDK Directory service can create the user, place them in the OU and add the group, triggered by a new row in an HR sheet. Someone writes it, owns it and keeps it inside Apps Script’s quotas.
• Patronum: Jordan is created in the Sales OU, and the onboarding policy scoped to that OU adds the Google Group, shares the files and folders, and applies the signature on its next hourly run. Patronum keeps “Google Group membership in sync with the policy,” so moving Jordan to another team later updates access too (Patronum Help).

All three get Jordan set up. The difference is who builds it, who maintains it, and what happens when Jordan changes teams or leaves. Workspace Studio and AppSheet come in later, for the sales work itself.

The options at a glance

Option	Main job	Code needed	Published limits or notes	Maintained by
Google Workspace Studio	Workflow	No	25 flows per user, 20 steps per flow	Google
Apps Script	Workflow; admin through the Admin SDK Directory service	Yes (JavaScript)	6 minutes per execution; 6 hours a day of trigger runtime on Workspace	Google (your code is yours)
AppSheet automation	Workflow (data-driven apps)	No	Bots built from events, processes and tasks (AppSheet Help)	Google
Admin SDK (Directory API)	Admin	Yes	Manages users, groups, org units, devices	Google (your code is yours)
GAM7	Admin	Command line	Free, open source	Community (Jay Lee, Ross Scroggs)
No-code admin platforms (Patronum and others)	Admin and lifecycle	No	Policy-based; paid	Vendor

Workflow automation

Google Workspace Studio (formerly Workspace Flows)

Google Workspace Studio is Google’s no-code tool for building AI agents that automate everyday work. Google describes it as “an evolution of the capabilities we released in alpha as Google Workspace Flows,” and it’s “generally available with all Business and Enterprise Workspace plans” (Google Workspace).

Know the limits before you build: a maximum of 25 flows, up to 20 steps per flow, and Google notes “Limits are subject to change” (Workspace Studio Help). Studio is still growing: nested conditionals and a “Search for a Doc” step began rolling out on 13 October 2026 (Google Workspace Updates).

In WebWisp’s own Google Workspace account (October 2026), Studio’s Discover page grouped 28 templates under Email boosters, Better meetings, Connect your team, Tasks and action items, Customer connections, and Everyday essentials. None of them provisions, suspends or offboards users, changes licenses or transfers Drive ownership. The closest is “Welcome new team members to a space,” which posts to a Chat space. As of October 2026, Studio is a workflow tool, not an admin one, though Google is still adding to it.

The flow builder tells the same story. Its starters are schedules, manual runs and events in Gmail, Chat, Sheets, Drive, Calendar, meetings and Forms, and its steps cover Gmail, Chat, Sheets, Drive files and folders, Calendar, Docs, Tasks and Gemini. In WebWisp’s account we found no starter or step that creates or suspends a user, changes group membership or organizational units, assigns a license or transfers Drive ownership.

Apps Script

Apps Script is Google’s JavaScript platform for custom automation inside Workspace. It’s free with your account, and it reaches both sides of the split: everyday workflows through the built-in services, and admin work through the Admin SDK Directory advanced service, which gives administrators “the ability to manage devices, groups, users, and other entities in their domains.” You have to enable the advanced service before use, and the Admin SDK must be enabled on your domain (Apps Script, Admin SDK Directory Service).

Quotas shape what it can do. Each execution can run for 6 minutes, triggers get 6 hours of total runtime a day on Workspace accounts, and Google says quotas can change without notice (Apps Script quotas). That’s plenty for a few new starters a week. It gets tight for loops over thousands of users, and someone has to own the code after its author moves on.

Google Workspace admin automation

The Admin SDK

The Admin SDK’s Directory API sits under most admin tooling, including GAM and the Apps Script Directory service. Google lists jobs like “Creating and managing users and adding administrators” (Google for Developers). Calling it directly is the most flexible route and the most work: you write, host and secure the code yourself.

GAM7

GAM is “a command line tool for Google Workspace admins to manage domain and user settings quickly and easily” (GAM on GitHub). GAM7 is free and open source, installs with pip install gam7, and is maintained by Jay Lee and Ross Scroggs rather than by Google. If you used GAMADV-XTD3, it “has been replaced with GAM7” (GAMADV-XTD3 on GitHub).

GAM is fast for bulk changes, but it needs someone comfortable on the command line and a machine to run scheduled jobs. Our guide to GAM alternatives for Google Workspace covers the no-code options.

No-code lifecycle automation

No-code admin platforms turn lifecycle rules into policies. In Patronum, an admin sets up three things:

• A user template for new accounts, with mandatory fields, an email address format, a welcome email and license assignment (Patronum Help).
• An onboarding policy scoped to all users, an OU or a Google Group, narrowed by conditions such as Department or Job Title, with actions for groups, file sharing, signatures and licenses (Patronum Help).
• An offboarding policy driven by conditions such as Suspended or End Date, or by moving the user to an offboarding OU, that can transfer Drive files to a manager or a shared drive, remove the user from Google Groups, change licenses and archive the leaver’s email to your own Google Cloud Storage bucket (Patronum Help; Patronum Archive).

Policies run hourly by default, with an optional daily, weekly or monthly schedule. A new policy stays inactive until you activate it (Patronum Help).

Patronum isn’t the only option: BetterCloud covers many SaaS apps beyond Google Workspace, Zenphi suits teams building custom no-code workflows, and GAT Labs pairs workflow (GAT Flow) with audit and security tooling.

A note on access

No-code doesn’t mean low access. Tools that act for every user typically use domain-wide delegation, which gives an app “access to the data belonging to all of your users” (Google Workspace Admin Help). Patronum does too, and lists its OAuth scopes publicly (Patronum Help). Review scopes for any tool, coded or not.

Applying it: six months later, Jordan leaves

Leaving is where the routes split most. With GAM or Apps Script, someone has to remember to run the leaver steps in the right order, and the code has to handle Drive files, groups and licenses. With a lifecycle policy, the admin suspends Jordan or moves the account to the offboarding OU, and the next hourly run transfers the Drive files, removes the group memberships and changes the license.

If your team happily maintains code, Apps Script or GAM7 is a capable, low-cost route. If joiners, movers and leavers fill your automation backlog and nobody wants to own scripts, a policy-based tool fits better.

Before trusting either with a real departure:

• Run the flow on a test account first and confirm every step completed.
• In Patronum, use the policy’s PREVIEW button to see which users it will target. Policies that would affect more than 80% of users need approval before they run (Patronum Help; Patronum Help).
• Confirm the recipient can open the transferred files before you delete the account.

See how Patronum automates Google Workspace onboarding, read our guide to Google Workspace user provisioning, or check what the Admin console itself can’t automate. To compare platforms, see the best Google Workspace management software.

Sources

• Google Workspace, Workspace Studio: https://workspace.google.com/studio/
• Workspace Studio Help, limits: https://support.google.com/workspace-studio/answer/16765942?hl=en
• Google Workspace Updates, new logic and search steps in Workspace Studio (9 October 2026): https://workspaceupdates.googleblog.com/2026/10/new-logic-and-search-steps-in-workspace-Studio-help-expand-automation-capabilities.html
• Google for Developers, Apps Script Admin SDK Directory Service: https://developers.google.com/apps-script/advanced/admin-sdk-directory
• Google for Developers, Apps Script quotas: https://developers.google.com/apps-script/guides/services/quotas
• AppSheet Help, automation components: https://support.google.com/appsheet/answer/11431791?hl=en
• Google for Developers, Directory API guides: https://developers.google.com/workspace/admin/directory/v1/guides
• Google Workspace Admin Help, domain-wide delegation: https://knowledge.workspace.google.com/admin/apps/control-api-access-with-domain-wide-delegation
• GAM on GitHub: https://github.com/GAM-team/GAM
• GAMADV-XTD3 on GitHub: https://github.com/taers232c/GAMADV-XTD3
• Patronum Help Center, when policies run: https://help.patronum.io/en/article/when-will-my-policy-run-13y3b4c/
• Patronum Help Center, creating a policy: https://help.patronum.io/en/article/creating-a-policy-jmctey/
• Patronum Help Center, creating an offboarding policy: https://help.patronum.io/en/article/creating-an-offboarding-policy-15zeh9t/
• Patronum Help Center, new user templates: https://help.patronum.io/en/article/how-to-use-new-user-templates-3i50zu/
• Patronum Help Center, what can I do in Patronum: https://help.patronum.io/en/article/what-can-i-do-in-patronum-1237l5u/
• Patronum Help Center, API scopes: https://help.patronum.io/en/article/how-to-manually-add-api-scopes-for-patronum-ms5q6n/
• Patronum, Archive: https://www.patronum.io/archive-user-data
• BetterCloud, Google Workspace: https://www.bettercloud.com/google-apps
• Zenphi, employee offboarding: https://zenphi.com/employee-offboarding-and-data-archiving/
• GAT Labs, GAT Flow: https://gatlabs.com/gat-flow/

---

Writer notes (not for publishing):

Revision changes (14 Oct):
– Removed the absolute claim (“none of them is built for onboarding or offboarding users”) and the whole ChatGPT/Gemini paragraph. Intro now uses the review’s framing: “Some tools provide ready-made lifecycle policies; others let you build the workflow through code or integrations.”
– Added that Apps Script can manage users and groups through the Admin SDK Directory advanced service, verified by WebFetch 13 Oct 2026 (developers.google.com/apps-script/advanced/admin-sdk-directory: “gives administrators of Google Workspace domains (including resellers) the ability to manage devices, groups, users, and other entities in their domains”; advanced service “must be enabled before use”; Admin SDK must be enabled on the domain). Table row, Apps Script section, Jordan example and misconceptions updated to match.
– Moved the new-sales-hire example to directly after the intro (three routes: GAM7, Apps Script, Patronum). The ending now applies the split to the same hypothetical (Jordan leaving), per the explainer format.
– Patronum section made concrete: user template (N6), onboarding policy scope/conditions/actions (S11, S12, N2, N4, N5), offboarding conditions and actions (T1, O1, O4, O11, A1), hourly run and activation (S5, S6), PREVIEW (S13), 80% approval (S7).
– Worked in “Google Workspace admin automation” (H2) and “lifecycle automation” (H3 and body); both added to secondary keywords.
– Dropped the FAQ: all three questions were answered in the body. Cut the AppSheet section (kept as a table row with its source), the Google Flow naming note, and three of four misconceptions (the Flows/Studio and GAM points are already in their sections; the Apps Script one is now answered in the body); the access point is kept as a short section. Folded the Admin console limitations link into the closing links.
– Workspace Studio “Search for a Doc” and nested conditionals re-verified 13 Oct 2026 (post dated 9 Oct 2026, rollout from 13 Oct 2026). Dropped the 19 March 2026 “reached all domains” line to cut length.
– No Patronum API claimed. The Jordan example still doesn’t say how Jordan is created; the user template bullet covers the Patronum route.
– Not applied: none of the review points were skipped.
– Also cut: Studio launch date, Apps Script 20-trigger detail and quota quote, the X1 policy-principle quote, one Directory API quote.
– Body word count after revision: about 1,340 including table, lists and headings (about 1,150 prose). Slightly over the 800 to 1,100 explainer target because of the added Apps Script admin detail and concrete Patronum setup the review asked for.

• USP rule: Archive worded as email only.
• Competitor lines are generic, from CF Art 4 “who it suits” notes. Re-check each linked page before publishing.
• Placeholders: image now inline (img/slot12-workspace-studio-discover.png, Discover page rather than the flow builder); one FIRST-HAND TEST PENDING narrowed to the flow builder’s step list.
• First-hand tests (13 Oct): used T5 (Studio enabled in the WebWisp tenant; six template categories, 28 templates, none provisions, suspends or offboards users, changes licenses or transfers Drive ownership; closest is “Welcome new team members to a space”). Worded “as of October 2026” with a note that Google is still adding to Studio. Flow builder step list checked 13 Oct (test log T7): no user, group, OU, license or ownership steps. Nothing pending. Adds about 75 words of prose to a body already over the explainer target.
• Basket alignment: 35, 37, 38. Counts toward the guarantee basket.
• Paul questions affecting this: Q9/Q11 (customer API/webhooks), Q10/Q12 (HR/IdP triggers).