Transition steps for Postini Hybrid customers
The steps for your service transition will vary depending on your Postini customer type. If you’re a Postini Hybrid customer:
- You're a Google Apps customer who can route mail to on-premise mail servers.
- In addition to Google Apps, you also use Postini message security or message discovery (archiving).
- You log in to the Google Admin console and the Postini Admin Console with separate login credentials.
The transition for Postini Hybrid customers includes the following steps:1. Prepare for your transition
Prior to initiating your service transition, follow these preparation steps:
- If you route some of your mail to an on-premise mail server, change your firewall settings - You’ll need to adjust your firewall configuration if you have non-Gmail mailboxes or delivery endpoints such as Exchange mailboxes, ticketing systems, or other on-premise systems. If this is true for you, your on-premise email server and firewall must be configured to allow mail traffic from Google IP ranges. We recommend that you make this change immediately even if you haven’t received your transition invitation. For instructions, see Allow email from Google IPs to your email server.
- Configure your SPF record - If you already have an SPF record, you’ll need to update your existing SPF record to include _spf.google.com to work with Google Apps and avoid failed delivery of outgoing mail. If you need to update your existing SPF record, we recommend that you make this change immediately even if you haven’t received your transition invitation. For instructions, see Configure SPF records to work with Google Apps. If you do not already have an SPF record, do not create a new SPF record until after your transition is complete. Partial or incomplete SPF records may cause delivery and spam classification issues.
- Change your Google Apps Directory Sync (GADS) and Directory Sync Service (DSS) settings -- If you already use GADS and DSS, you'll need to modify your GADS settings, and disable GADS and DSS before your service transition begins so that GADS does not make any changes.
Do not enable or re-enable GADS until you are notified that your orgs, users, and settings have transitioned from Postini to Google Apps.
- Optional: We recommend that you create a pilot org in Postini with a subset of test users - During your transition steps, you can use the Postini Transition Console to route your mail through Google for specific organizational units. This will enable you to test mailflow to Google Apps for a subset of your users before completing your transition. To prepare for this step, we recommend that you set up a pilot org in Postini prior to your service transition.
- Verify ownership of your domains -- If you haven’t yet verified ownership of your domains, you must complete this step before you can begin your transition. If this applies to you, you’ll receive an email from Google with details about which domains must be verified. If you fail to verify a domain, that domain will not be transitioned -- including that domain’s users and settings, as well as any archive data (if you’re a Postini GMD customer). Verify ownership of your domains by adding them to your Google Apps account. For instructions, see Add a domain or domain alias.
- Turn off non-account bouncing in Postini -- Before you begin your transition to Google Apps, be sure to turn off non-account bouncing in Postini if this feature is already turned on. If you fail to turn off non-account bouncing, mail may be bounced for any new users you add to Google Apps during your service transition. To turn off non-account bouncing:
- Sign in to Postini.
- Click Orgs and Users.
- Click the top-level org.
- Click General Settings.
- Under Non-Account Bouncing, select Off.
- Click Save.
- Confirm that your Postini admins have the correct administrative privileges -- Before beginning your transition, make sure that only admins who need access to Postini have access. Assign root admin privileges to admins who are responsible for completing your transition steps, and remove privileges for admins who shouldn’t be allowed to progress the transition. Communicate the transition plan to any admins that typically should have these rights. For instructions on changing Postini permissions, see Viewing and Editing Authorization Records in the Message Security Administration Guide.
- Learn about managing spam, users, or archiving during service transition -- Before you begin your transition, it’s important to understand when filtering or archiving services transition from Postini to Google Apps and Vault and the common tasks that administrators and users can do during GMS or GMD transition.
Transition Invitation email
Once your account is eligible for transition, Google will send a Transition Invitation email to administrators for your domain as well as your organization's business contact. Your Transition Invitation email will provide a link to the Transition Console, where you can log in using your Postini Admin Console username and password. You can then click the Begin Transition Now button to automatically copy your orgs, users and email settings from Postini to Google Apps. Note: If your account includes multiple domains, you'll be given the option to select the primary domain for your account before you initiate your service transition in the Postini Transition Console.
For detailed instructions, see Use the Postini Hybrid Transition Console.
Note: We’ll automatically copy your Postini data to a new organizational unit, so your existing Google Apps configuration will not be overwritten:
- Your Postini OU structure will be replicated in a new OU below your top-level OU in Google Apps.
- Any users that exist only in Postini will be created within this new hierarchy.
- Your transitioned Postini settings will be created in this new hierarchy.
During this process, your mail flow and filtering will continue without interruption, your MX records will continue pointing to Postini temporarily, and your Postini Admin Console will be in read-only mode.
Your Transition Invitation email will specify the deadline for you to complete your transition -- which is within 60 days of receiving this email. (Note that online customers will have 30 days to complete their transition. For details, see What's different if I purchased Postini online? in the Postini Transition Resource Center.)
For many domains, the process of moving your orgs, users, and settings from Postini to Google Apps will be completed within a few minutes, but it may take longer for many other domains. You'll receive a confirmation email when the process is completed, and the Transition Console will display updates so you can monitor the status of your transition. Once you receive your confirmation message, proceed to the next step in your transition process: Review your Google Apps configuration, and modify if needed.
If you’re a GMD customer, you’ll receive two confirmation emails when this process is completed -- one to notify you when your email security settings have been transferred, and another to notify you when your GMD archive data has been transferred. The transfer of your GMD archive data will depend on the size of your archive, and likely will require a period of many weeks, so you won't receive these confirmation emails simultaneously.
- Manually assign licenses for new users: G Suite licenses are not auto-assigned to newly created Google Apps users during your service transition. Therefore, you'll need to manually assign G Suite licenses to any new users that you create during your transition. This enables your newly created Google Apps users to receive email during your transition. If new users are unable to access services like Gmail, Calendar and Drive, it may be because they do not have a license assigned to them. For instructions, see Assign product licences for users > Assign a license to individual users.
- Re-enable Automatic License Assignment after your service transition: Once you receive a confirmation email that instructs you that mail is now routing through Google Apps, you may wish to re-enable Automatic License Assignment in the Google Admin console. For instructions, see Assign product licences for users > Assign a license to every user in your account.
- For GMD customers: Once you begin your transition, do not delete Google Apps users or remove their Google Vault license. Deleting user accounts or removing their Google Vault license can negatively affect your GMD data transition. You can suspend Google Apps users and apply a Vault Former Employee license without any negative effects. For instructions, see Assign Vault Former Employee licenses.
One-to-many mapping scenario
Postini Hybrid customers have accounts set up in both Postini and Google Apps. If there’s a basic one-to-one mapping, your Postini domains will be automatically mapped to Google Apps. However, if you have a single Postini account and multiple Google Apps accounts, you’ll need to use the Transition Console to manually map each of your Postini domains to an appropriate account in Google Apps.
You can access the Transition Console by clicking a link in your transition invitation email, or by signing in to your Postini Administration Console after you’ve been invited. You’ll know that you have a “one-to-many” mapping scenario if you see a set of drop-down lists in the Transition Console that enable you to map your Postini domains. For more details, see One-to-many mapping during your Hybrid transition.
If you plan to or already use GADS -- After you are notified that your orgs, users, and settings have transitioned to Google Apps, you'll need to create exclusion rules to prevent GADS from deleting the Google Apps user accounts that are created during your service transition for former employees, Postini-only users, and sharded user accounts. Then, enable GADS to synchronize user accounts.
If you're a GMD customer transitioning to Google Vault: Once you begin your transition, do not delete Google Apps users who have archive data you would like to retain. Deleting user accounts can negatively affect your GMD data transition. You can suspend Google Apps users and apply a Vault Former Employee license without any negative effects. For instructions, see Assign Vault Former Employee licenses.
We will notify you when your GMD transition process is completed, after which time you may want to combine pre- and post-transition OU structures so that GADS manages all user accounts.
The G Suite Terms of Service (ToS) will be presented to all administrators who log in to the Google Admin console after orgs, users, and email settings transition from Postini, including administrators uninvolved with the transition.
Occasionally, the Vault-Hangout amendment about product compatibility will also be presented to the first super administrator who logs in to the Google Admin console. If your organization will be using Hangouts, that administrator can choose either Continue using Hangouts to enable Hangouts or Disable Hangouts to opt in later. See Getting started with Google Hangouts for more information.
After accepting the ToS and the Vault-Hangout amendment, if presented, administrators will have immediate access to the Admin console. The ToS and Vault-Hangout amendment will not be presented to users in your organization.
Note: To ensure that API operations continue to function, ensure that all service accounts used for Google APIs accept the ToS and acknowledge the Vault-Hangout amendment.
Once you receive a confirmation message that your orgs, users, and settings are copied to Google Apps, you’ll need to review and verify your settings in Apps, move users if needed, modify your organizational structure if needed, and review your routing settings.
During your service transition, your Postini GMS OU structure is replicated in a new OU below your top-level OU in Google Apps. After this is done, you may wish to adjust your orgs by moving users and/or copying settings. To review your Google Apps settings and org structure, sign in to the Google Admin console. Note that while making adjustments to your Google settings, mail will still flow from Postini.
From the Google Admin console, do the following:
- Review and verify your transitioned settings (see Getting started with Google Apps email settings and Configure advanced settings for Gmail).
- If needed, copy settings from your transitioned Postini OUs to an OU that’s already existing in your Google Apps org structure. For example, you may want to copy an outbound Content compliance setting to your root OU in Google Apps. By doing this, the setting will apply to all of your Google OUs, not just your transitioned Postini OUs. You should also evaluate whether you need to copy other transitioned settings -- for example, the Append footer setting and the Objectionable content setting.
For instructions on how to copy a setting to another OU, see Configure advanced settings for Gmail: How to use the controls on the Gmail Advanced settings page.
- Review your organizations, and if needed modify your organizational structure (see Modify the organizational structure).
- Review your users, and if needed, move your users to the appropriate organizational units (see Move a user to an organizational unit).
- If needed, enable domain default routing (see Default routing setting for instructions).
- Verify routing to your on-premise mail hosts. If needed, adjust the Non-Gmail mailbox routing setting (see Non-Gmail mailbox routing).
Important: In rare cases, you may have an appliance or mail hop on the outbound routing path between your sending mail system (Google Apps or on-premise mail system) and Postini. If this scenario applies to you, you’ll need to change your outbound routing from Postini to Google Apps before completing the next step: 5. Follow the steps in the Postini Transition Console to route your mail through Google. Changing your outbound configuration before step 5 will help you avoid mail flow issues during your transition.
For instructions on changing your outbound configuration, see Route your outbound mail through Google Apps in Steps to complete your transition.
Once you have reviewed your Google Apps configuration, return to the Postini Transition Console to complete your transition. You’ll need to follow the steps in the Transition Console to route your email through Google, and then observe mail flow in your domain before completing your transition.
How to access the Postini Transition Console
Your Transition Invitation email provides a link to the Transition Console, where you can log in using your Postini Admin Console username and password, or you can sign in directly to Postini and click the links to the Transition Console.
Using the Postini Hybrid Transition Console to finish your transition
During your service transition, your Postini orgs, users, and settings were copied to a new organizational unit (OU) in your Google Apps account, and the Postini Admin Console was placed in read-only mode. However, your mail continues to be routed through Postini temporarily, and Postini filtering remains in effect.
Once you have verified your Google Apps configuration, it’s time to re-route your Postini mail to Google Apps. Before you do this, test your mail flow by selecting ON for a subset of organizational units, or select ON for all OUs. You can then test mail flow to and from users in your domain, and click OFF if needed.
Once your Google Apps configuration is working to your satisfaction, select ON for every organizational unit, and click Finish transition.
If you're a Postini archiving (GMD) customer, clicking Finish transition also begins the transfer of your GMD archive data.
- Support for Postini mail filtering will end on May 31, 2015, as a step towards Postini EOL and shutdown. You must take action to finish your transition before that time to avoid interruption of mail flow.
- If you do not finish your transition steps, your Postini account will be automatically transitioned on the deadline date specified in your transition emails. Failure to take action by this deadline may result in loss of email messages for your organization and users. Note the following:
- If you take no action, the system will automatically begin your transition, initiate the passthrough phase, and then will automatically initiate the Finish action on the force-transition date.
- If you have clicked Begin and your account is in passthrough on only a subset of your OUs, the system will automatically initiate the full passthrough and then will automatically initiate the Finish action on the force-transition date.
- If you have clicked Begin and if you are in the full passthrough state, but haven't clicked Finish, the system will automatically initiate the Finish action on the force-transition date.
If you are not a Google Message Discovery (GMD) customer transitioning to Google Vault, skip this step.
The GMD transition process is similar to the process for Google Message Security (GMS). The transfer of your GMD archive data will depend on the size of your archive, and likely will require a period of many weeks, so you won't receive these confirmation emails simultaneously.
We’ll notify the root admin for your domain with a confirmation email when this process is completed. Once you receive confirmation that your GMD transition is completed, see Getting started with Google Vault. This article provides guidance for using Vault after your service transition, and specifies details for performing many common tasks in Vault that are comparable to Postini archiving. Before you make any changes to your Vault configuration, read all of the instructions in the above article carefully.
You'll need to complete a few cleanup steps after your settings transition is complete; for example, changing your MX records from Postini to Google Apps. For instructions, see Steps to complete your transition.
Note to GMD customers: Once you click Finish (for Postini Hybrid customers) or click Start (for Postini Classic customers), you begin archiving in two places, both Vault and GMD, and continue to do so until your MX records no longer point to Postini, and your transition is complete. During this time, you’ll need to search in both Vault and GMD for a comprehensive eDiscovery search, since some messages will only be in GMD, and some messages may only be in Vault (if you change MX records, add users in Apps, etc.).
Postini Integrated customers
A small percentage of Postini customers are defined as Postini Integrated customers. These customers use both Postini and Google Apps but are not using on-premise servers. They can access both Postini and the Google Admin console with one login, and users are automatically synchronized between the two systems. For details, see Transition steps for Postini Integrated customers.