What is GAM?
GAM (Google Apps Manager) is an open-source command-line tool created by Jay Lee that interacts with Google Workspace APIs directly. It lets you do anything you can do in the Admin Console — and a lot of things you can't — from your terminal. Bulk user creation, forwarding rule setup, Drive ownership transfers, license assignments, group management, audit log exports: all scriptable, all repeatable, all fast.
I use GAM daily at Forter for everything from offboarding (setting forwarding rules, transferring Drive ownership) to routine reporting (who hasn't logged in recently, which users have 2FA disabled). It's the single most useful tool in my Google Workspace toolkit.
Installation
There are two main versions: the original GAM and GAMADV-XTD3 by Ross Scroggs. Use GAMADV-XTD3 — it has more features, better output formatting, and is more actively maintained. Install on macOS with:
Run gam oauth create and follow the browser prompts to authorise GAM with your Super Admin account. GAM will store the OAuth token locally — you won't need to re-authorise on every command. For automation scripts running unattended, you can also set up a service account with domain-wide delegation.
gam-admin@yourcompany.com) so you can audit GAM actions separately from your personal admin account.Commands You'll Use Every Week
The two most common offboarding tasks in Google Workspace. GAM handles both in seconds.
Indispensable when reorganising groups or rolling out new tools to a department.
Run this before every security review. Takes under 10 seconds for a 500-person org.
Great for licence audits and finding stale accounts that should be suspended.
When a company rebrands or merges, this saves hours of clicking through the Admin Console.
My Most-Used GAM Scripts
I wrapped the most common offboarding GAM commands into a single Bash script: suspend account, set out-of-office, set forwarding, transfer Drive, remove from groups, reset sign-in cookies. Triggered by our offboarding pipeline. What used to take 30 minutes of Admin Console clicking now runs in under 2 minutes with a full log.
A cron job that runs every Monday morning: exports all active users with their last login date, filters for anyone who hasn't logged in for 60+ days, and emails the report to IT. Catches contractors and temporary accounts that slip through offboarding.
Lists all Shared Drives, their membership, and storage usage. Runs quarterly as part of our access review process. The output feeds into a spreadsheet that managers review to confirm their team's access is still appropriate.
Common Mistakes to Avoid
all users runs immediately on your entire domain. Test with gam user test@company.com ... first, then expand scope when you're confident.
Use gam print before gam update. Print commands are read-only — they let you see exactly what would be affected before you make changes. Make it a habit: print first, review the CSV, then run the update.
Log every automated command. Any GAM command running in a script should redirect output to a timestamped log file. When something goes wrong (and eventually it will), you want a clear record of what ran and when.
GAM has saved me hundreds of hours over the years. Once you get past the initial setup and learn the command patterns, it becomes the fastest way to manage Google Workspace at scale — far faster than the Admin Console for anything involving more than a handful of users. If you're setting it up and run into issues, feel free to reach out at izzi@izzirenan.com.