Inactive Workspace for Education accounts will be automatically deleted! 🔥

[Kim_Nilsson]

Inactive Workspace for Education accounts will be automatically deleted! 🔥

UPDATE: This only applies to the whole Workspace, if all users and admin accounts have been inactive for 2 years!

Read carefully.

https://support.google.com/a/answer/16110912?hl=en-GB

There are some exceptions.

Accounts with the Archived licence are exempt.

Accounts affected by a current Vault retention rule.

But as soon as the retention expires, the account will be deleted.

If all user and admin accounts are inactive for two years, the entire Workspace account is at risk of being deleted.

There will be warning notifications, but if nobody logs in to the accounts... Who's going to see them?

Make sure your known inactive users have the correct licence.

[sundermannc]

This is interesting, and looks like it could affect us.

We have a number of service accounts that we don't log into (for copiers, monitoring, etc). We also have many delegated accounts that also never get logged into directly. (attendance, invoices, etc)

Curious about other people's thoughts on this.

[alexgrutza]

So I've created processes around the 2 year mark prior to this wonderful notification, though maybe not as robust since we don't look at the OUs which house employees or students, only alumni (we're higher ed).

As noted, the 2 year watermark won't apply to accounts which have a hold on them, until they're moved from that OU to an OU with no hold.

In our organization, I have previously created a "Service Account" OU within Google, and put a hold on that OU so that accounts cannot be deleted from there. This hold would supersede the 2 year mark is my understanding. 

[JantechNJ]

We too have a Service Account OU but I'm not seeing the "hold" option that you mention as being an exception exempting them from the 2 year deletion mark. I also don't see a way to apply a hold option to an OU.  Can you elaborate?

[Scott]

I assume the hold mentioned is in reference to your vault retention rules.  Check in vault.google.com -> retention for your default rules and custom rules (if you have any set).  We have default rules applied to our whole domain, so I am guessing this change will not affect us much.  

[panderson]

That's my understanding. If you have retention set to xxxx days, then one would expect after that many days, the account would be deleted. It may save people from having to manually delete accounts after the time period set.

[alexgrutza]

I interpret the following to also apply to Holds within Vault. Though I may go through and create a dedicated Retention Rule now for the OU for both Gmail and Drive data.

• Your Google Workspace for Education Account has an active Vault retention rule applied.

If Holds are treated as Retention in the terms of this notification, then you would go to:

• Vault \ Matters \ Holds tab \ Create \ Select a service (we just use Gmail) \ Select the OU \ For the date: we just enter a space into the Query box, then delete it which allows us to save it

For the Retention I just created for both Gmail and Drive are:

• Retention \ Custom Rules \ Create \ Select service (I just did Gmail and Drive) \ Select OU \ Data range leave blank (I did) \ Duration Indefinitely

Seems like this notification in regards to "if you have a retention rule" is kind of broad and doesn't necessarily seem to apply to us at least. We have a default retention rule for all services as "Indefinitely" so in theory no student account or other account would be deleted if they haven't signed in within 2 years. 

Also, Google needs to specify what the login timestamp they're using may refer to. In our custom scripts for suspending and deleting users, we have to use the lastlogintime timestamp in which all Admins can see within the Admin Console. However, there are other login timestamps that get updated when in reality that timestamp isn't necessarily truly of a user logging in. For example, Google docs say that even if a user receives an email and doesn't open it, that could trigger the login time to be updated for some timestamp related to email_receive_timestamp or something.. 

[JantechNJ]

Thank you so much for the clarification and detailed guidance. I will dig into those Vault retention rules and make sure they are applied to our service OUs. 

[Brendan-NH]

It appears to me that this will affect all accounts (exceptions noted in the linked article) without an archive license.

For example, an account provisioned with a Google Workspace for Education Fundamentals license that has not been logged into for 5 years will be automatically deleted.

How do others perceive my above assumption? 

[panderson]

Article says:

"Vault retention rules apply to inactive users. Users whose data is retained using Vault will not be considered inactive until the duration of the specified retention period has expired."

So if I read and understand this correctly. If we have vault retention rules set as "Duration = Indefinitely", and "Action after expiration = No expiration", then this should not affect us? I am guessing that if you had a duration set for "5 years (1,825 days)", the accounts would be deleted after 5 years?

Does that sound right?

[Kim_Nilsson]

UPDATE: This only applies to the whole Workspace, if all users and admin accounts have been inactive for 2 years!

I just recently got the translated version of the news, and the writing was much clearer this time around.

It does NOT affect individual user accounts.

Sorry for the scare, two weeks before Halloween. 🤣