suspended_accounts
Snapshot of currently suspended Google Workspace accounts, per domain.
Instructions
Snapshot of currently suspended Google Workspace accounts, per domain.
A suspended-but-still-provisioned account is a common attack surface: an account disabled in Google may remain enabled in a downstream IdP (e.g. KeyCloak), where a password-spray attacker can still authenticate through it. Cross-reference this list against the IdP to find and disable such gaps.
Unlike login_audit (which reports the event of Google disabling an
account within a time window), this is current state — every account
suspended right now, regardless of when. Read-only (Directory API
users().list with query=isSuspended=true). Requires the
admin.directory.user.readonly DWD scope; a domain missing that grant
degrades to {"error": ...} for that domain only. capped is set when
max_pages was hit before the listing was exhausted.
Coverage is per configured domain (Directory domain= filter), unlike the
customer-wide Reports tools — every domain you want covered (e.g. a separate
student domain) must have its own [domain.*] config section, or its
suspended accounts are not listed.
Args:
domain: Restrict to one configured domain (default: all).
max_pages: Page cap (500 accounts/page); capped=true means more exist.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | ||
| max_pages | No |