Set up Vault privileges

Control who can use specific Vault features

As a Google Workspace administrator, you can allow users in your organization to do all Vault tasks or only a specific subset. For example, you might allow certain users to set retention rules, and allow a different group to search and export data.

Before you give users Vault privileges, consult with your organization's legal experts or business personnel to determine which users require access to Vault tools. For some Vault privileges, such as managing searches or exports, you can restrict the privilege so that the user can work with only user data in a specific organizational unit.

Accounts with Vault privileges should be treated as sensitive because they have access and control over other users’ data in your organization.

To grant privileges to a user, you create an admin role that includes one or more Vault privileges. Then, assign the admin role to the user.

Step 1: Create an admin role with Vault privileges

You must be signed in as a super administrator for this task.

  1. Sign in to your Google Admin console.

    Sign in using an account with super administrator privileges (does not end in @gmail.com).

  2. From the Admin console Home page, go to Admin roles.
  3. Click Create a new role.
  4. Enter a name and description for the role. For example, the name could be the privilege that the user will have.
  5. Click Continue.
  6. Locate and expand the Google Vault section. Tip: In the search box, enter “Google Vault”.
  7. Select privileges for the role.

    The following list provides a summary of privileges that you can combine as needed. For more details, on this page go to the Vault privileges reference.

    Search and export-related privileges:

    • Search data, preview results, and save queries, but not export search results–Select Manage Searches. To allow a user to search in any matter, not just matters owned by or shared with the user, also select View All Matters.
    • View, download, and delete exports, but not create exports–Select Manage Exports. To allow a user to work with exports in any matter, not just matters owned by or shared with the user, also select View All Matters.
    • Create exports, plus all other search and export actions–Select Manage Searches and Manage Exports. To allow a user to search and export in any matter, not just matters owned by or shared with the user, also select View All Matters.

    Holds, audits, and matter-related privileges:

    • Create and remove holds, view lists of holds–Select Manage Holds. To allow a user to create and remove holds in any matter, not just matters owned by or shared with the user, also select View All Matters.
    • View audit logs and holds for matters they can access, view all hold reports–Select Manage Audits.
    • Create, share, close, and delete matters–Select Manage Matters and at least one of the following: Manage Holds, Manage Searches, Manage Exports, or Manage Audits.

    Retention-related privileges:

    • Create, edit, and delete retention rules, plus view all retention rules–Select Manage Retention Policies.
    • View retention rules, but not create, edit, or delete them–Select View Retention Policies.
  8. Click Continue.
  9. Review the privileges you selected then click Create Role.

Step 2: Assign Vault privileges to users

You must be signed in as a super administrator for this task.

You can assign Vault privileges to one user at a time, or to several users at once.

With either approach:

  • Users usually get the new role within minutes, but it can take up to 24 hours.
  • You can give a user Vault privileges without giving them a Vault license. Users don’t need Vault licenses to have Vault privileges.
  • If the role includes only Manage Exports, Manage Searches, Manage Holds, and Manage Matters, you can restrict the scope of the role to a specific organizational unit.

For instructions, go to Assign roles.

Troubleshoot Vault privileges

User doesn’t have any matters listed on the Matters page

  • Why: If the user's admin role doesn't include the View All Matters privilege, then the user can only see matters they own and matters shared with them. The user won't see any matters if they don't own any and don't have any shared with them.
  • How to fix: Share matters with the user. For instructions, go to Share a matter.

User can’t open any matters

  • Why: If the user's admin role has only the View All Matters privilege and no other privileges, then the user can only view the list of matters but not open them.
  • How to fix: You have 2 options:
    1. Assign the user another admin role that includes another Vault privilege.
    2. Edit the user's assigned admin role to include another Vault privilege.

Vault privileges reference

Vault privilege What the privilege allows the user to do Can be restricted to organizational units
Manage Matters
  • Create matters and share those matters with other users.
  • Close, reopen, and modify matters.
  • Delete and restore matters.

Important:

A user must have at least one more privilege–Manage Holds, Manage Searches, Manage Exports, or Manage Audits– to open and work with matters.

When restricted to an organizational unit, the user can share matters only with accounts in the organizational unit.

Manage Holds
  • View the list of user accounts on hold.
  • Create holds.
  • Remove holds.

Important:

When this privilege is restricted to an organizational unit, the user can create and remove holds only for accounts in the organizational unit. Vault users outside the organizational unit can see holds on users in the organizational unit.

Manage Searches
  • Search data and count results.
  • View the contents of messages and files that are returned with search queries.
  • Create or delete saved search queries.

When this privilege is restricted to an organizational unit, the user can search only for data associated with accounts and shared drives in the organizational unit.

Manage Exports
  • View and download exports.
  • Delete all exports.

Important:

To create exports, a user needs this privilege and the Manage Searches privilege.

When this privilege is restricted to an organizational unit, the user can export only data associated with accounts and shared drives in the organizational unit.

Google Workspace super administrators don't have access to all exports. They can only work with exports they own and exports in matters shared with them.

Manage Audits
  • View audit logs for matters that were created by or shared with the user.
  • View all hold reports for your entire organization.
  • View holds in matters that the user has access to.
 
Manage Retention Policies
  • Create and view retention rules for your entire organization.
  • Update retention rules for your entire organization.
  • Delete retention rules for your entire organization.
 
View Retention Policies
  • View all retention rules for your entire organization.
 
View All Matters
  • View all matters in your entire organization.
 
Was this helpful?
How can we improve it?
Search
Clear search
Close search
Google apps
Main menu
Search Help Center
true
96539
false