The leaver process ends tidily: suspended, sessions killed, Drive transferred, licence reclaimed, groups removed. Then a year of nothing happens, and the account is still there, because legal or the manager said keep it.
At 500 people this is a line item. At 1500 it is a conversation with finance. We ran between eighty and a hundred archived accounts at any one time, and that number is the whole reason this is worth thinking about rather than defaulting.
Why the account stays at all
Three different reasons, which is exactly why a single blanket policy does not fit.
- Legal or regulatory. Something is disputed, or a regime requires the records be held for a defined period. Not negotiable, and the period comes from someone other than IT.
- Operational. The person owned a process, and for the next few months somebody will need to find a thread, a spreadsheet or an approval they sent. This is the most common reason by a distance.
- Nobody decided. The account was suspended and then forgotten. This is not a reason, it is the absence of one, and it is where most of the cost sits.
The retention period is per person, not per company
The instinct is to pick one number and apply it to everybody, because that is easier to write down. It does not survive contact with the actual requests.
Ours varied by individual. Some accounts were days, a contractor who finished a piece of work and whose manager confirmed there was nothing to keep. Most were months. Some were a year or longer because legal said so. The period was set by whoever owned the risk for that person, and IT recorded it rather than invented it.
Ask the question at offboarding, not later. The leaver ticket should carry a field for how long, and who said so. Asking six months afterwards means asking a manager who has moved on about somebody they barely remember, and the safe answer they will give is "keep it", forever.
Record a date, not a state. "Keep for now" is not a retention period. A date is reviewable; "for now" never comes up again.
Review on a cycle, and make the review cheap. A list of accounts past their date, sent monthly to the people who own them, with deletion as the default if nobody objects. If the review is expensive nobody does it, and the list grows forever.
What you are actually paying for
A suspended account holding a normal licence costs the same as an active one. Multiply by ninety and it is a real number, and it is a number finance will eventually find on their own, which is a worse way for them to find it.
Google's answer to this is an archive licence, which is cheaper than a full one and keeps the account's data retained and searchable in Vault. The tradeoff is the part to be clear about before you buy: an archived account is not a usable account. Nobody signs into it. It is storage with discovery on top.
Whether that is the right trade depends entirely on the next section, and this is the question I would want answered before switching a fleet of accounts across.
What it actually takes to get back in
Here is the part that documentation does not tell you, and the reason to think carefully about archiving everything.
When somebody needs something from a departed employee's account, what they ask for is almost never what discovery gives them. They do not want a Vault export of every message matching a term. They want somebody to open the mailbox, find the thread from March, and read what was agreed. Or to get into a Drive folder and see how the files were organised, because the structure is half the information.
So when we needed it, we did not export. We put the account back into service: moved it into an appropriate organisational unit, assigned a licence, and signed in as the user to do whatever was needed. Then it went back to suspended.
It is a privileged action, so treat it as one. Signing in as a former employee's account is access to everything they had. Ours ran with a named requester and a reason, not on a favour. If you do this without a record, you have created an audit finding for somebody to discover later.
The organisational unit matters. A reactivated account should land somewhere with policy that suits a temporary, supervised account rather than back in the department it left, where it inherits whatever a normal employee gets.
Put it back. The step people skip. A reactivated account that stays licensed and enabled is a live credential belonging to somebody who does not work there.
None of that is possible on an archive licence. That is the trade, stated plainly: archiving saves money on accounts you will only ever search, and takes away the option on accounts somebody will need to walk around inside.
How to put it to finance
Not as "we need budget for leavers". As three numbers and a choice.
- How many accounts are being held, and how many are past their retention date. The second number is usually the persuasive one, because it is waste rather than cost.
- What they cost on full licences today, against archive licences, against deletion.
- What each option gives up. Delete and the data is gone, including for a dispute nobody has raised yet. Archive and you can search but not enter. Keep and you can do anything, at full price.
Then let the business choose, and write down what they chose. The value of that document is not the decision, it is that the same conversation stops happening every year.
The short version
Departed accounts cost money for as long as you hold them, so the retention period belongs to whoever owns the risk for that person and should be a date rather than a feeling. Review past-date accounts on a cycle with deletion as the default. Archive licences are cheaper and keep data searchable, but an archived account cannot be entered, and the real request is usually to go in and look around rather than to search. When you do reactivate one, it is privileged access: named requester, suitable organisational unit, and put it back afterwards.