Why Workspace accounts linger
When someone leaves, Google doesn't suspend or delete their account automatically. The account stays active, the license stays assigned, and the monthly billing continues. Most offboarding processes cover revoking laptop access and maybe transferring files, but the Workspace account itself often gets forgotten — especially for short-term contractors or consultants who were added informally.
Google also doesn't distinguish between a user who logged in yesterday and one who hasn't touched their account in eight months. Both show as "active" in your billing.
Option 1: The Admin console reports
The quickest place to start is the Admin console. Go to admin.google.com, then Reports → Users. This gives you a per-user breakdown of last activity across Gmail, Drive, Meet, and other apps, along with their last login date.
You can filter by date and export the report as CSV. Anyone with no activity in the last 30 days and an active license is a candidate for review. While you're in the admin console, check Billing → Subscriptions to see your current seat count vs. how many users you actually have.
One thing to watch: the Reports section has a data lag of up to 48 hours, and activity data only goes back a limited window depending on your Workspace edition. Business Starter has less historical data than Enterprise editions.
Option 2: Pull last login via the Admin SDK
If you want to script this or get more granular data, the Admin SDK Directory API is the right tool. The lastLoginTime field on each user object gives you the exact timestamp of their most recent sign-in.
You'll need a service account with domain-wide delegation, or you can use the gam command-line tool (open source, widely used by Workspace admins) which wraps the Admin SDK without requiring you to write API code:
GAM (command line)
# List all users with their last login time gam print users fields lastlogintime,suspended > users.csv # Or filter to only non-suspended users gam print users query "isSuspended=false" fields lastlogintime,primaryemail > active_users.csv
The lastLoginTime value of 1970-01-01T00:00:00.000Z (Unix epoch zero) means the user has never logged in at all — their account was created but they never signed in. These are often safe to remove immediately.
Suspended vs. deleted — what's the difference
Google Workspace has two states that matter here. A suspended account retains its license assignment — and depending on your Workspace edition and how long the account has been suspended, it may still count toward your billing. A deleted account always releases the license. Many admins suspend departing users instead of deleting them to preserve their data, not realizing they may still be paying for that seat.
Check Directory → Users → Add a filter → Suspendedto see which accounts are suspended. You may still be paying for these licenses, depending on your Workspace edition and the length of time the account has been suspended. If data retention isn't required, delete the account to release the license. If you need to keep the data, transfer Drive files and emails before deleting, or use Google Vault if you're on a plan that includes it.
What to check before removing anyone
A few things to verify before you remove a license or delete an account:
- Shared accounts and service accounts. Some "users" aren't people — they're accounts used by apps, bots, or shared inboxes. Their last login might be zero but they're very much in use.
- Calendar and Drive ownership. If the user owns shared calendars or Drive files that others depend on, transfer ownership before deleting the account. Google gives you a 20-day window after deletion to recover data.
- Email forwarding rules. Some departed users have email forwarding set up to redirect mail to a team inbox. Check for this before removing the account.
The audit is a one-time fix; the problem is ongoing
Running through this once will find stale accounts. But people keep leaving, contractors keep getting added, and roles keep changing. Without something checking continuously, you're back in the same position in six months.
Manual audits tend to happen once or twice a year — usually when someone notices the Workspace bill is higher than expected. By then you've paid for several months of accounts nobody was using.
Running this automatically
Reach Seats connects to your Google Workspace tenant via OAuth and checks last login activity against every licensed account every 24 hours. It flags anyone inactive for 30+ days, shows you the monthly cost of each flagged seat, and keeps the list fresh automatically.
It also covers Microsoft 365, GitHub, Slack, Zoom, and Jira in the same dashboard — so if you're running a mixed environment you're not doing separate audits for each provider. 7-day free trial, no credit card required.