Assign Vault Former Employee licenses

Note: This feature is currently available only for customer domains that have transitioned from Postini (Google Message Discovery) to Vault.

Vault Former Employee (VFE) licenses are no-cost ($0) licenses that enable a Vault administrator to search, hold, export, and retain data in Vault for inactive user accounts. VFE licenses remove all Google licenses from user accounts and turn off all licensed apps and services except Vault. Assigning a VFE license should be a final step in your organization’s employee deprovisioning process.

During the Postini-to-Google Apps transition, Google Apps user accounts are created for former employees and assigned VFE licenses. These user accounts include VFE.x prepended to the username (for example, and are in a Former Employee organizational unit. To simplify account management, consider renaming VFE user accounts by using the VFE.x.username format and moving them to the VFE organizational unit. You can exclude the VFE organizational unit from Google Apps Directory Sync.

To determine who needs a license, a Vault administrator must consult with people in the organization who understand its business and legal requirements. The Vault administrator can then work with the domain's Google Apps administrator, who can assign licenses to the appropriate users in the Admin console.

  1. Sign in to the Admin console.
  2. Click Billing.
  3. In the Google Vault row, click Settings then Manage licenses.
  4. Click Assigned users.
  5. Check the box next to the user to assign a license.
    See Assign product licenses to users for information about assigning VFE licenses to a list of users, users in an organizational unit, or all users in a domain.
  6. Click Assign and select Vault Former Employee.
    If you have used all of your VFE licenses, see the Vault Former Employee license FAQ.
  7. Click Assign License.
    We recommend that you also suspend the user to prevent sign in and access to unlicensed apps and services.

Do not unlicense or delete an account that is assigned a VFE license without understanding the results and implications. See Vault Former Employee license FAQ.

Assign VFE licenses with Google Apps Directory Sync

You can also use Google Apps Directory Sync (GADS) to deprovision Google Apps users and assign VFE licenses.

  1. In Active Directory create a group and add those users that you want to assign a VFE license to.
  2. In GADS, add a new license rule. 
    • Select the license type Google Vault Former Employee.
    • Use an LDAP query that specifies the users that need the license. For example, put all users into a single group and then specify an LDAP query that applies to members of that group:


    • Don't enable the Remove this license option.

For detail on how to set up GADS and sync licences, see see Set up your sync with Configuration Manager

Some hybrid Google Message Discovery (GMD) customers need to maintain thousands of Vault Former Employee (VFE) licenses to preserve the archived email messages of former employees. If you’re an administrator for such an organization, you have the option to use API calls to programatically deprovision Google Apps users while assigning VFE licenses to these same users. This enables you to keep your Vault data preserved during and after your GMD transition. If this scenario applies to you, see the Enterprise License Manager API.

Was this helpful?
How can we improve it?