domainwidedelegation.comStart free

Use cases → Admin and governance

Send password expiry reminders to all users automatically

Alert users ahead of password expiry using a delegated service account to query and email at scale.

Who it is forWorkspace administrators responsible for password policy compliance.
APIsAdmin SDK, Gmail API
Typical scopesadmin.directory.user.readonly, gmail.send

The problem

Users forget to change their passwords before expiry, leading to lockouts and IT helpdesk tickets. Manual reminders are inconsistent, and built-in notifications are easily overlooked or disabled.

How it works

  1. Use the Admin SDK to fetch all active users and their password change timestamps.
  2. Calculate days to expiry based on your policy.
  3. For users within the warning window, send personalised reminder emails via the Gmail API as the service account.
  4. Log each notification for audit and follow-up.

What changes

Every user receives timely, consistent reminders, reducing lockouts and manual admin effort.

The trap in this one. The Admin SDK's password change timestamp is only updated by actual user-initiated changes—admin resets or syncs from an external IdP do not update it. This means reminders can be sent to users whose passwords have just been reset by IT or by SSO sync, causing confusion and false alarms. Always verify your directory's password source and test with real edge cases before rollout.

Watch it explained

“Google Service Account” — Xano on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Can I customise the reminder email content?

Yes, the Gmail API lets you send fully customised messages. Just be sure to avoid spam-like wording or your notices may be filtered.

How do I handle users with SSO?

If your users authenticate via SSO, the Workspace password may be unused or out of sync—avoid sending reminders unless you confirm they're relevant.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.

Reduce an over-broad delegation grant safely

Find out which scopes your automation genuinely uses, then cut the grant down to them.