Vault Former Employee (VFE) licenses are currently available only for the customer domains that transition from Google Message Discovery (GMD) to Vault.
Vault Former Employee licenses are no-cost ($0) licenses that enable a Vault administrator to search, hold, export, and retain data in Vault for inactive user accounts. VFE licenses remove all Google licenses from user accounts and turn off all licensed apps and services except Vault.
FAQ for G Suite administratorsHow do I unlicense an employee who has left the organization?
Before unlicensing any user with an assigned Vault license, the G Suite administrator should talk to the organization's Vault administrators, Vault investigators, or the legal or compliance team to confirm that the user no longer needs a license because:
- If you unlicense a Vault user and also remove the G Suite license, user data may be lost, as the data will no longer be managed by Vault.
- If you remove only the Vault license, user data may also be lost due to the following possibilities:
- The user is no longer searchable in Vault.
- Any holds on the user's data are removed.
- Vault retention policies no longer apply to the user's data.
- Any email or chat messages that the user deleted are purged from Google's systems.
- If you also remove the G Suite license, all user data may be subject to purging from Google’s systems.
If an employee leaves and you want to keep the employee’s user data, you should assign a VFE license, which removes all Google licenses from the user's account and turns off all licensed services except Vault.
To unassign a license
- Sign in to the Admin console.
- Click Billing.
- To the right of Google Vault, click the overflow icon , and then click Manage Licenses
- Make sure that Auto-assign the following license is unchecked.
- Go to Assigned users, check the boxes next to user’s name, and click Unassign.
- The Admin console displays an alert reminding you of the impact of unlicensing.
If you cancel your G Suite subscription, all user data is deleted and can't be restored. This includes data in Vault and your VFE licenses. To preserve user data in Vault, do not cancel your G Suite subscription or remove VFE licenses.
If you delete a user account, all data managed by Vault is subject to deletion. Deleting the user account also deletes that employee’s Vault archive. To keep a user’s data in Vault, do not delete the user account or remove the VFE license.
The VFE license disables all licensed G Suite services for the user account.
By default, transitioning customers are granted 10,000 VFE licenses. If you want to request more VFE licenses, you can do the following (depending on whether you obtain additional G Suite licenses online or offline):
There are two primary methods for assigning Vault Former Employee licenses to user accounts:
- You can assign VFE licenses to an individual account, a .csv list of accounts, all existing user accounts in a given organizational unit, or all users in the domain in the Google organizational unit in the Admin console.
Assigning licenses to an organizational unit affects only users in the organizational unit at the time that the assignment is made. It does not assign licenses to users in any suborganizations. Additionally, moving users in and out of that organizational unit later does not change their assigned licenses.
- You can use the License Manager Application Programmer Interface (API) to assign licenses to user accounts.
Assign the user account a Vault license to remove the VFE license and then license the user for G Suite if auto-assign is not enabled.
If a user is without a Vault or VFE license, Vault-retained data for the user account may be purged from the system and no longer discoverable.
Even if a G Suite user account exists for a Postini user before the transition, an additional VFE account may be created to archive GMD data under certain conditions. See the user accounts, Vault licenses, and Vault privileges section in Getting started with Google Vault.
FAQ for Vault administratorsHow do GMD and Google Vault differ in retention of former employee data?
GMD stamps messages with a retention time when seen by the Postini Simple Mail Transfer Protocol (SMTP) servers. These messages remain in GMD and are discoverable after the Postini user is deleted. With Vault, a VFE license is required to retain user data; if a Google Vault user account is deleted, the user data is not retained or discoverable.
Yes. Google Drive documents are included in Google Vault Drive searches for a user account with an assigned VFE license. As part of your deprovisioning process, consider transferring ownership of a former employee’s Drive documents to another employee.
For Postini GMD Hybrid customers where Postini Users map to G Suite Groups, a special VFE licensed user with a special groups address prefix group_archive_ is created in G Suite. This is created to migrate this archived email to a dedicated Gmail account. This is a $0 license, and a G Suite license is not required. (This applies only to GMD customers, not to GMS customers.)
It is possible the user's account data was transitioned to a VFE account and that information needs to be included in your search query. See the user accounts, Vault licenses, and Vault privileges section in Getting started with Google Vault.