The Suspended Account That Still Bills
A 240-person company uses Google Workspace Business Standard. Finance flags that the license count is 247 but HR's roster shows 240 active employees. You discover 7 accounts belong to contractors whose contracts ended 2-6 months ago. Their managers asked you to 'just leave them for now' because the contractors' Drive files contain project documentation the team still references. When you check, 4 of the 7 accounts are already suspended (someone did a partial cleanup), and 3 are still active and signing in. One suspended account owns 1.2 TB of shared project data in My Drive, not in a Shared Drive. A manager asks: 'Can we delete the 3 active ones today and keep the suspended ones since they're not costing us?' You need to reconcile the license count, preserve data access, and stop unauthorized sign-ins.
1. A manager believes suspended accounts don't cost licenses. Evaluate that assumption and explain what suspension actually does versus deletion, including the data-ownership consequence that matters here.
Read the worked answer
The assumption is wrong on two counts.
Licensing: A suspended user still consumes a Workspace license and still counts toward the subscription. Suspension blocks sign-in; it does not free a seat. Only deletion (after the required data transfer) removes the license. So the 4 suspended accounts are 4 of the 7 excess seats - the count stays at 247 until all 7 are deleted, not just the 3 active ones.
Data ownership: Suspended accounts retain ownership of everything in their My Drive. The 1.2 TB in the suspended account's My Drive is owned by that user, not by the team. If you delete the account without transferring ownership, that data is scheduled for deletion and the team loses access - Shared Drive membership does not protect files that live in a personal My Drive.
Correct sequence for each departing account:
- Transfer Drive data (and any other services: Calendar, Sites) to the manager or a Shared Drive before deletion.
- For the 1.2 TB case, move the project documentation into a Shared Drive so ownership is organizational, not personal.
- Then delete the account to reclaim the license.
- Do not delete the 3 active accounts first without the same transfer step.
Net effect: all 7 must be processed (transfer then delete) to reach 240. 'Keep the suspended ones' preserves neither money nor data safely.
2. The 3 still-active contractor accounts are signing in. Describe the immediate containment steps and the order you'd take them, and explain why you wouldn't simply delete those accounts right away.
Read the worked answer
Order matters - contain first, delete last.
- Suspend the 3 active accounts immediately. This is the fastest reversible control that stops sign-in without destroying data. Do this before anything else so no further access occurs.
- Revoke sessions / reset credentials as needed so any existing tokens are invalidated. Suspension plus session revocation closes the door.
- Audit what they accessed. Pull login and Drive audit logs for the period after contract end. Check for data exfiltration, sharing changes, or OAuth grants to third-party apps. If a suspicious OAuth token exists, revoke it.
- Transfer ownership of their My Drive content to the appropriate manager or Shared Drive.
- Delete only after transfer is confirmed, to reclaim the license.
Why not delete first:
- Deletion is destructive. If you delete before transferring, the data is unrecoverable after the retention window and you've lost project documentation the team says it needs.
- You lose the ability to audit what the account did while active if you delete prematurely in some workflows; suspend, investigate, then delete.
- Deletion is the last step because it's the only irreversible one.
Suspension is the safe default; deletion is the cleanup.
3. Recommend a durable process so this doesn't recur, naming the specific controls and the metric you'd track.
Read the worked answer
Process controls:
- Lifecycle tied to HR/IdP: Drive account provisioning and deprovisioning from the authoritative HR system or the identity provider, not from ad-hoc manager requests. A contractor end date should trigger an automated suspension on that date.
- Offboarding checklist with a data-transfer step: before deletion, require ownership transfer of My Drive content to a manager or Shared Drive. No transfer = no deletion.
- Default new project data to Shared Drives: Shared Drive files are owned by the organization, so departures don't strand data. This directly prevents the 1.2 TB problem.
- Manager accountability: require a documented owner for every non-employee account and a review cadence (e.g., quarterly access review).
- Separation of duties: the person who deletes accounts shouldn't be the only approver; require a second check.
Metric to track: licensed seats vs. active roster headcount reconciled monthly, plus number of accounts past their end date still active or suspended-but-undeleted. The gap (247 vs 240) is the signal; drive it to zero and keep it there. Also track mean days from contract end to suspension - target same-day.