user suspend workflow if archived first

[MioG663783]

I'm following up on an administration question that came up for our organization.  The online help content doesn't state this explicitly. 

We have users who were archived, but are not suspended.  The Admin UI allows active users to be suspended or archived, but an archived user cannot be suspended using UI.  Is there any supported method of directly suspending an already archived user?  We don't want to unarchive users to do this.  

This is a problem when we need to determine if a user is active, using LDAP.  The suspended LDAP attribute is the only value that's close to indicate if a user "active" but the UI doesn't require that attribute to be set to true for an inactive user.  

[b_gorsky1]

Curious as to why you want to suspend an archived user? I believe once they are archived they can no longer use the account.

[MioG663783]

Because "archived" is not stored as an LDAP accessible directory attribute for the user.  The only attribute which appears in LDAP is the "suspended" boolean value.  On the topic, the "suspended" attribute isn't listed in the user schema: https://support.google.com/a/answer/9188164 but both suspended and archived values exist in the API reference: https://developers.google.com/admin-sdk/directory/reference/rest/v1/users

[MioG663783]

The idea is to archive offboarded users, but to properly detect a user as offboarded, only the suspended attribute is usable via LDAP.  It would follow that the user has to be suspended first, then archived.  The obstacle is once a user is archived, they cannot also subsequently be suspended - for what's, in my opinion, no good reason.  

[b_gorsky1]

I understand.

[MioG663783]

Clarifying the question:

Is there any supported method of directly suspending an already archived user?  The Admin UI doesn't allow this.  Can we achieve this via LDAP or API?

[tangerinehuge]

I assume you found the answer to this by now but in case anyone else is wondering you can accomplish this via GAMADV-XTD. Here's how to do it with a single user and to all archived but non-suspended users in the domain.

Single user:

gam update user user@domain.com suspended on

All archived non-suspended users:

gam print users query "isSuspended=False isArchived=True" | gam csv - gam update user ~primaryEmail suspended on