5 Account inventory (incl. shared/service accounts)

Caveats

• The inventory is only as good as its ‘unowned = suspicious’ rule¹
• lastLoginTime is blank for accounts that have never signed in and for some SSO paths²
• Suspended accounts still hold data and can be re-enabled by any super admin³

Setup steps

1. Export the authoritative user list with GAM (the command-line Google Workspace admin tool) and store it as the dated inventory snapshot.

   gam print users fields primaryEmail,name,suspended,isAdmin,isDelegatedAdmin,lastLoginTime,creationTime,orgUnitPath > users-$(date +%F).csv

   Download a list of users ↗ REST Resource: users | Admin SDK Directory API ↗

2. Export groups and their membership, so shared mailboxes and service identities are captured too.

   gam print groups fields email,name,description,adminCreated > groups-$(date +%F).csv  &&  gam print group-members > group-members-$(date +%F).csv

3. open ↗

   

   https://admin.google.com/ac/owl/domainwidedelegation · captured 2026-07-15

   Security › Access and data control › API controls › Manage Domain Wide Delegation ↗

   Enumerate non-human identities that never appear as ordinary users: service accounts and domain-wide delegation clients.

   Cross-check GCP service accounts and Security > Access and data control > API controls > Manage Domain Wide Delegation against the register

   Control API access with domain-wide delegation ↗ List and edit service accounts ↗

4. open ↗

   

   https://admin.google.com/ac/users · captured 2026-07-15

   Directory › Users ↗

   Reconcile the export against the human register (HR list + owned shared accounts) and open the console on any row that has no owner.

   Diff = zero unexplained accounts; every account has a named owner and a purpose

5. open ↗

   

   https://admin.google.com/ac/groups · captured 2026-07-15

   Directory › Groups ↗

   Flag groups with external members or no owner for the exposure lockdown control (№32).

   Owner set; external members reviewed

Ongoing maintenance

• automatable: script Monthly: re-export users/groups/delegation clients and diff against the register.
• requires a human Monthly: triage every unowned or unexplained account the diff surfaces.

How to verify

1. Check the newest inventory snapshot is no older than the cycle, then re-run the export and diff — an inventory is only as good as its date.

   gam print users fields primaryEmail,suspended,lastLoginTime > users-check.csv && diff <(sort users-check.csv) <(sort users-<last-date>.csv)