Vault Former Employee license FAQ
Vault Former Employee (VFE) licenses are currently available only for the customer domains that transition from Google Message Discovery (GMD) to Vault.
Vault Former Employee licenses are no-cost ($0) licenses that enable a Vault administrator to search, hold, export, and retain data in Vault for inactive user accounts. VFE licenses remove all Google licenses from user accounts and turn off all licensed apps and services except Vault.
FAQ for Admin console administratorsHow do I unlicense an employee who has left the organization?
Before unlicensing any user with an assigned Vault license, the Google Apps administrator should talk to the organization's Vault administrators, Vault investigators, or the legal or compliance team to confirm that the user no longer needs a license because:
- If you unlicense a Vault user and also remove the Apps license, user data may be lost, as the data will no longer be managed by Vault.
- If you remove only the Vault license, user data may also be lost due to the following possibilities:
- The user is no longer searchable in Vault.
- Any holds on the user's data are removed.
- Vault retention policies no longer apply to the user's data.
- Any email or chats that the user deleted are purged from Google's systems.
- If you also remove the Apps license, all user data may be subject to purging from Google’s systems.
If an employee leaves and you want to keep the employee’s user data, you should assign a VFE license, which removes all Google licenses from the user's account and turns off all licensed services except Vault.
To unassign a license
- Sign in to the Admin console.
- Click Billing.
- To the right of Google Vault, click the overflow icon , and then click Manage Licenses
- Make sure that Auto-assign the following license is unchecked.
- Go to Assigned users, check the boxes next to user’s name, and click Unassign.
- The Admin console displays an alert reminding you of the impact of unlicensing.
If you delete a user account, all data managed by Vault is subject to deletion. Deleting the user account also deletes that employee’s Vault archive. To keep a user’s data in Vault, do not delete the user account or remove the VFE license.
The VFE license disables all licensed Google Apps and services for the user account, but does not stop the user from receiving mail. To stop mail delivery to the user, we recommend that you suspend the user account.
By default, transitioning customers are granted 10,000 VFE licenses. If you want to request more VFE licenses, you can do the following (depending on whether you obtain additional Google Apps licenses online or offline):
- Online—Contact support.
- Offline—Follow the same process that you normally use to add other Google Apps licenses.
There are two primary methods for assigning Vault Former Employee licenses to user accounts:
- You can assign VFE licenses to an individual account, a .csv list of accounts, all existing user accounts in a given organizational unit, or all users in the domain in the Google organizational unit in the Admin console.
- Assigning licenses to an organizational unit affects only users in the organizational unit at the time that the assignment is made. It does not assign licenses to users in any suborganizations. Additionally, moving users in and out of that organizational unit later does not change their assigned licenses.
- You can use the License Manager Application Programmer Interface (API) to assign licenses to user accounts. For more details, see Manage VFE licenses with the License Manager API.
Assign the user account a Vault license to remove the VFE license and then license the user for Google Apps if auto-assign is not enabled.
If a user is without a Vault or VFE license, Vault-retained data for the user account may be purged from the system and no longer discoverable.
Even if a Google Apps user account exists for a Postini user before the transition, an additional VFE account may be created to archive GMD data under certain conditions. See the Apps user accounts, Vault licenses, and Vault privileges section in Getting started with Google Vault.
FAQ for Vault administratorsHow do GMD and Google Vault differ in retention of former employee data?
GMD stamps messages with a retention time when seen by the Postini Simple Mail Transfer Protocol (SMTP) servers. These messages remain in GMD and are discoverable after the Postini user is deleted. With Vault, a VFE license is required to retain user data; if a Google Vault user account is deleted, the user data is not retained or discoverable.
Yes. Google Drive documents are included in Google Vault Drive searches for a user account with an assigned VFE license. As part of your deprovisioning process, consider transferring ownership of a former employee’s Drive documents to another employee.
For Postini GMD Hybrid customers where Postini Users map to Google Apps Groups, a special VFE licensed user with a special groups address prefix group_archive_ is created in Google Apps. This is created to migrate this archived mail to a dedicated Gmail account. This is a $0 license, and a Google Apps license is not required. (This applies only to GMD customers, not to GMS customers.)
It is possible the user's account data was transitioned to a VFE account and that information needs to be included in your search query. See the Apps user accounts, Vault licenses, and Vault privileges section in Getting started with Google Vault.