A user drops out of the Active Users count in the Real-Time Overview report after five minutes of inactivity.
This calculation can be somewhat surprising, since a Google Analytics session terminates after 30 minutes of inactivity.
In either case, each hit that a visitor sends back to Google Analytics refreshes the visitor’s active status for another full five minutes and the session for another 30. Similarly, the expiration of the _ga cookie, which identifies a unique user, is refreshed for two years with each hit, and the campaign timeout is refreshed for six months. (You can override the default user and campaign timeouts in the property admin, but you’re probably fine to stick with the two-year and six-month defaults for most implementations.)
More about campaign timeout in an upcoming post.