Skip to main content
  1. CloudM
  2. Archive
  3. Get Started
  4. CloudM Archive Configuration

Configure Archive Vault

Updated

You can configure CloudM Automate to archive a user's Google Vault data as part of an offboarding workflow. This article covers setting up the Google Cloud project, adding the service account in Archive, and adding the Archive Vault step to a workflow.

Archive Vault only archives deleted Mail and Drive items: data that has been permanently deleted from the user's account but is retained in Google Vault.

Archived Google Vault data is indexed in the same way as other archived data. When you restore, it is shown with a "Vault" label.

Google Vault export limits

For Google Vault export quotas and how to configure several service accounts, see Google Vault export limits.

Set up a Google Cloud Platform project

Automated method (PowerShell)

This method uses a PowerShell script to automate most of the process. It is quicker than the manual process and less prone to error.

Before you start, you need:

  • An account in GCP with permission to create a project (the resourcemanager.projects.create role), or owner on an existing project.
  • The ability to run a PowerShell script as Administrator.
  • A browser window open and signed in to the GCP tenant. This must be the last browser tab you used.

To run the PowerShell script:

  1. Install the Google Cloud SDK using Google's installation instructions.
  2. Make sure the Google Cloud SDK is initialised by running gcloud init, and follow the instructions.
  3. Once the Google Cloud SDK has finished initialising, download the GCP_Vault_Configuration.ps1 file to your desktop.
  4. Click the desktop search icon (next to the Start icon) and search for Windows PowerShell.
  5. Select Run as Administrator.
  6. Hold Shift and right-click the GCP_Vault_Configuration.ps1 file, then select Copy as path.
  7. In the Windows PowerShell window, type CD and a space, paste, then press the up key until you see the first half of the file path, and press Enter. It looks similar to CD C:\Users\(your name)\Desktop.
  8. On the next line, press the up key until you see the second half of the file path, and press Enter. It looks similar to & '.\GCP_Vault_Configuration.ps1'.
  9. On the Project ID line, enter a unique project ID. It must be 6 to 30 lowercase letters, digits or hyphens. It must start with a lowercase letter, followed by one or more lowercase alphanumeric characters that can be separated by hyphens. It cannot end with a hyphen.
  10. On the Service Account ID line, enter a unique service account name. You can use the same name as the project ID, or follow the same naming rules.
  11. On the Output Path line, specify where the JSON key and log will be saved on your computer, for example C:\CloudM\GCPVaultConfig.
  12. The script runs and shows the details and manual instructions you need to carry out.
  13. For "Step 1 - Configure Google Workspace Domain Wide Delegation using the following ClientId and Scopes", copy the URL shown in the PowerShell window and paste it into a browser.
  14. On the Security > API Controls > Domain-wide Delegation screen, select Add new to open the Add a new client ID window.
  15. Copy the Client ID and OAuth scopes from the PowerShell window into those fields, and select Authorize.
  16. For "Step 2 - Service Account details", copy the service account email address. You need it when you add the service account in Archive.
  17. The JSON key file you also need is saved to the output path you chose, for example C:\CloudM\GCPVaultConfig, along with a gcp_vault log of the process.

Manual method

To configure the GCP project manually, follow Google's service account creation guide to set up a service account and generate a JSON key file. Once you have the service account email and JSON key, continue to the next section.

Add service accounts in Archive

  1. In CloudM Automate, go to Archive > Vault Configuration.
  2. Select Add access key.
  3. Upload the service account JSON key into the Service Account for Google Vault field.
  4. Enter the email address of an administrator in the Admin email field.
  5. Select Test Connection to check the connection works.
  6. Select Save.

The rebuilt Archive Vault Configuration screen

To add more service accounts, repeat these steps for each one, up to 5. More service accounts give Archive more threads to work with and improve performance.

Remove a Vault configuration

You can remove a Google Vault configuration from the same screen.

Add the Archive Vault step to your offboarding workflow

These steps assume you are adding the Archive Vault step to an existing offboarding workflow. You can add it alongside the standard Archive step. For the other steps you can add, see Offboarding workflows.

  1. Sign in to CloudM Automate.
  2. Click Automate > Offboarding Workflow.
  3. Select the root organisational unit (at the top of the list, shown with an office block icon) or a child organisational unit below it.
    • To apply the Archive Vault step to a Smart Team, select the Smart Team tab and click the Smart Team you need.
    • Child organisational units inherit the policy from their parent unless you set an explicit offboarding policy.
  4. If the organisational unit is not the root, select Explicitly set Offboarding Policy to edit the process for that unit.
  5. If you selected a Smart Team, make sure the workflow is set to Enable, so it takes precedence over the user's organisational unit policy.
  6. Select Add Offboarding Step.
  7. Find the Archive Vault step and select its checkbox.
  8. Choose whether to archive emails, chats and Drive documents by selecting the relevant checkboxes. Mail and Drive are selected by default. To include Chat, select Archive chats.
  9. Select Add to Workflow. The Archive Vault step now appears in the workflow.
  10. Select Save Rules to confirm your changes.
Was this article helpful?
0 out of 0 found this helpful