Google Vault Configuration


Google Vault is heavly throttled by default with limits to 20 active export threads per organization. You can request these limits be raised but it takes a few days for the changes to take effect.


For either source or destination the Google Vault requires the source/destination Domain and the Super Administrator account.

Service Account and P12 or JSON Access Key for Google to SaaS Access

A Service Account needs to be created with the correct scopes for the data access and an associated P12 or JSON key. This account is entered in the configuration and the P12 or JSON key file is uploaded into CloudM Migrate.

The whole process can be performed via a PowerShell script.

  1. Download and install the Google Cloud CLI.
  2. Download the GCP Configuration script.
  3. Run PowerShell as Admininstrator and execute the script.
  4. You’ll be prompted to enter a Project ID and a Service Account ID which are arbitrary names.
  5. You’ll be prompted to enter the Scope, choose one of the following:
    • All - Recommended for Google to Google
    • Standard
    • SourceLimited
    • DestinationLimited
    • Vault
    • Storage
  6. You’ll be prompted to continue the process by navigating to a URL to Configure OAuth Consent. Do not close PowerShell.
  7. On the OAuth consent page, set the User Type to Internal and select Create.
  8. Set the App name to CloudM Migrate, and add a User Support email and a Developer Contact email address.
  9. Navigate to Security > API Controls > Domain-wide Delegation page, select Add New.
  10. The PowerShell script will have output the ClientID and OAuth Scopes to copy and paste in the Add New dialog.
  11. Select Authorize.
  12. You can now add the Service Account email to CloudM Migrate.
  13. The P12 or JSON Access key will be located under C:\CloudM\GCPConfig and can be uploaded into CloudM Migrate.

NOTE: Replication can cause a delay of 2 hours before these can be used to migrate data.

Google Vault Throttling

Google Vault is heavliy throttled by default. Google has options for lifiting this throttling for an additional change.

Chat History

By default Classic Chat History is not migrated. To migrate Classic Chat History as email on the destination enable the Migrate Chat History option.


By default SPAM is not migrated however it’s possible to include SPAM by enabling the Export Spam Emails option.

Domain Name

The name of the domain that is being transferred to Google Apps. This can be either a primary or secondary domain.

Admin Username

The Google Apps admin email that will be used to perform email migration and user creation (this must be a primary domain administrator account).

Service Account Email Address

Your service account Email address, available after setting up a service account as described in the documentation.

Private Key

The location of your service account private key. Please provide the full path.

Was this article helpful?
0 out of 0 found this helpful