3 Ways to Archive Users in Google Workspace

As a Google Workspace admin, offboarding is more than disabling a login. You need to preserve email and Drive data, reduce license spend, and keep security tight.

This guide walks through three practical ways to archive users: Archive User (AU) licenses, suspending accounts with Vault-based retention and ownership transfer, and exporting or transferring data before deletion. You’ll see the trade-offs for compliance, searchability, recovery, and cost so you can choose the right path.

Table of Contents

• Use Google Workspace's UI
• Use Torii
• Use Google Workspace's API

Use Google Workspace’s UI

Here, you’ll use the Google Admin console to archive a user so you keep their data while removing access. This follows Google’s own steps from the Admin Help articles “About Archived Users” and “Archive a user.”

Know what “archiving a user” does

Archiving replaces the user’s active Google Workspace license with an Archived User license. The user can’t sign in, email is rejected, and services stop. Their data stays available to admins and for eDiscovery with Google Vault. If others had access to their Drive files, that access continues.

• Common use cases:
  • Keep data for legal or compliance needs
  • Free up a standard license without deleting the account

Make sure you have Archived User licenses

You need enough Archived User (AU) licenses before you can archive someone. Google covers this in “About Archived Users” and “Manage licenses.”

• Check or add licenses:
  • In the Admin console, go to Billing.
• Open your subscriptions. Look for Archived User. If you don’t see it, go to Get more services and add Archived User.
• Make sure you have at least one available AU license.

(Optional) Transfer key data before archiving

If you want someone else to own this user’s Drive files or primary calendar, transfer it first. Google documents this in “Transfer Drive files to a new owner” and “Transfer a user’s data.”

• To transfer data:
  • In the Admin console, go to Directory, then Users.
• Click the user’s name.
• Click Transfer data.
• Choose what to transfer and the new owner, then start the transfer.

Archive the user in the Admin console

Google’s “Archive a user” article outlines this flow. Here’s the UI path:

• Archive a single user:
  • In the Admin console, go to Directory, then Users.
• Click the user’s name.
• Click More actions.
• Click Archive user, then confirm.
• Archive multiple users:
  • In Directory > Users, check the boxes next to the users.
• Click More actions.
• Click Archive users, then confirm.

What you should see after a successful archive:

• The user’s status shows as Archived.
• Their license shows Archived User.
• Mail to that account bounces, and the user can’t sign in.

Verify retention and access

If you use Google Vault, confirm your retention rules and holds cover this archived account. Google notes in “About Archived Users” and “Set up retention in Vault” that Vault can search and retain data for archived users.

• Quick checks:
  • In Vault, run a test search for the archived user.
  • In Drive, have a collaborator confirm they can still open shared files.

Unarchive later if needed

You can bring the user back by assigning a standard Google Workspace license. Google covers this in “Reactivate an archived user.”

• To restore access:
  • In the Admin console, go to Directory, then Users.
  • Filter by Archived or search for the user.
• Open the user, click Reactivate user or Manage licenses.
• Assign a Google Workspace license and save.

Notes:

• You must have an available standard license to reactivate.
• Messages sent to the user while archived were rejected and won’t appear in their mailbox after reactivation.

Use Torii

Instead of working directly in Google Workspace, you can leverage Torii, a SaaS Management Platform, to archive user in Google Workspace. SMPs let you manage all your SaaS subscriptions and integrations in one place, making it simple to programmatically on/offboard users, review subscription details, and more.

With Torii, you can automate this task so it runs automatically when a trigger occurs-no manual steps required. Triggers can include a new hire, an exiting employee, a contract renewal, and similar events. This saves time and reduces repetitive work when the action needs to happen often.

To archive user in Google Workspace straight from Torii, follow these steps:

1. Sign up for Torii

Contact Torii, and ask for your free two-week proof-of-concept.

2. Connect your Google Workspace account to Torii

Once your account is live, connect Google Workspace to Torii (assuming you already have an account). Here are the instructions for the Google Workspace integration.

3. Create a Torii workflow for Google Workspace

In Torii, build an automated workflow to archive user in Google Workspace. Navigate to the Workflows tab, choose a trigger, and add the action that will archive user in Google Workspace. From then on, whenever the trigger is met, Google Workspace will be updated automatically.

Use Google Workspace’s API

Here, you’ll use Google’s Admin SDK Directory API and the Enterprise License Manager API to archive a user. You’ll suspend the account to block sign-in, remove the active Workspace license, then assign the Archived User license to keep their data.

Set up auth and scopes

Use OAuth 2.0 with an admin user or a service account with domain wide delegation. The calls below require these scopes:

• https://www.googleapis.com/auth/admin.directory.user
• https://www.googleapis.com/auth/apps.licensing

Have a bearer token ready and a few variables:

• USER_KEY is the user’s primary email or user ID.
• AU_SKU is the Archived User SKU ID from the Enterprise License Manager API docs under productId Google-Apps.

Example env setup is:

export TOKEN="YOUR_OAUTH2_BEARER_TOKEN"
export USER_KEY="[email protected]"
export AU_SKU="ARCHIVED_USER_SKU_ID"

Suspend the user to block sign in

This keeps the account data while preventing access. Use Users.patch.

Example curl is:

curl -s -X PATCH \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
"https://admin.googleapis.com/admin/directory/v1/users/$USER_KEY" \
-D '{
    "suspended": true
}'

List the user’s current Google Workspace licenses

You need to know which Google-Apps SKU(s) the user holds so you can remove them before assigning the Archived User license. Use LicenseAssignments.listForUser.

Example curl is:

curl -s -X GET \
-H "Authorization: Bearer $TOKEN" \
"https://licensing.googleapis.com/apps/licensing/v1/user/$USER_KEY/licenses"

Look for items where:

• productId: Google-Apps
• skuId: the current Workspace plan(s) on the user

Save those skuId values for the next step.

Remove the active Google Workspace license(s)

For each Google-Apps license on the user that is not the Archived User SKU, delete it with LicenseAssignments.delete.

Example curl is:

curl -s -X DELETE \
-H "Authorization: Bearer $TOKEN" \
"https://licensing.googleapis.com/apps/licensing/v1/product/Google-Apps/sku//user/$USER_KEY"

Assign the Archived User license

Use the Archived User SKU ID from the Enterprise License Manager API docs for productId Google-Apps. Then call LicenseAssignments.insert.

Example curl is:

curl -s -X POST \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
"https://licensing.googleapis.com/apps/licensing/v1/product/Google-Apps/sku/$AU_SKU/user" \
-D '{
    "userId": "'$USER_KEY'"
}'

Verify the archive state

Confirm the account is suspended.

Example curl is:

curl -s -X GET \
-H "Authorization: Bearer $TOKEN" \
"https://admin.googleapis.com/admin/directory/v1/users/$USER_KEY?projection=full"

Check the license now shows the Archived User SKU.

Example curl is:

curl -s -X GET \
-H "Authorization: Bearer $TOKEN" \
"https://licensing.googleapis.com/apps/licensing/v1/user/$USER_KEY/licenses"

Notes that help avoid snags

• ProductId for Google Workspace licenses is Google-Apps in the License Manager API.
• The Archived User SKU ID is documented in the Enterprise License Manager API SKU table. Use that exact skuId value.
• If the user still has another active Google-Apps SKU when you insert the Archived User license, the call may fail. Remove active Workspace SKUs first.