domainwidedelegation.comStart free

Use cases → Admin and governance

Detect inactive accounts across your entire Workspace domain

Identify user accounts that have not signed in or sent email recently, so you can review, disable or remove them.

Who it is forWorkspace administrators responsible for account hygiene and licence management.
APIsAdmin SDK, Gmail API
Typical scopesadmin.directory.user.readonly, gmail.readonly

The problem

Unused accounts accumulate, increasing licence costs and security risk. Manual checks miss accounts that are technically active but unused for business purposes. You need a reliable, automated report to drive regular clean-up.

How it works

  1. List all users in the domain using the Admin SDK with a delegated service account.
  2. For each user, pull their last login time and account status.
  3. Optionally, query the Gmail API for last sent or received message if login time is insufficient.
  4. Aggregate the data and flag accounts meeting your inactivity threshold.

What changes

You get an actionable list of stale accounts, making regular reviews possible and defensible.

The trap in this one. The Admin SDK's 'lastLoginTime' field is not updated by API usage or some mobile apps—only by full web logins—so accounts can appear inactive when they are actually in use. Relying solely on 'lastLoginTime' will produce false positives; always cross-check with Gmail activity or another indicator before taking action.

Watch it explained

“How To Fix Service Account Key Creation Is Disabled In A Google Cloud Project” — TV2VN on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Does suspending an account free up its licence?

Suspending a user does not always immediately release the licence, depending on your Workspace edition. Check your admin console after each suspension.

How far back can I check email activity?

The Gmail API provides message metadata as far back as the retention policy allows. Deleted or purged mail cannot be used as an indicator.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.

Reduce an over-broad delegation grant safely

Find out which scopes your automation genuinely uses, then cut the grant down to them.