You can configure CloudM Automate to archive a user's Vault data as part of an Offboarding Workflow.
Note: Archive Vault only archives deleted Mail and Drive items - Mail and Drive data that has been permanently deleted from the user's account but is retained in Google Vault.
Note on Restoration: Archived Google Vault data is indexed in the same way as other archived data, and is displayed under a "Vault" label.
Google Vault Export Limits
For details on Google Vault export quotas and how to configure multiple service accounts, see Google Vault Export Limits.
1. Set up a Google Cloud Platform Project
Automated Method (PowerShell)
This method uses a PowerShell script to automate the majority of the process. It is easier and quicker than the full manual process, and less prone to error.
Before you start, you will need:
An account in GCP with permissions to create a project (resourcemanager.projects.create role) or owner on existing project,
The ability to run PowerShell Script as Administrator,
A browser window open and authenticated into the GCP tenant. This must be the last browser tab you have used.
To run the PowerShell:
Install Google Cloud SDK using the instructions provided by Google here,
Ensure that the Google Cloud SDK is initialized by running the "gcloud init" command, and follow the instructions.
Once Google Cloud SDK has finished initializing, download the GCP_Vault_Configuration.ps1 file to your desktop.
Click on your Desktop Search icon (next to the Start Icon) and search for Windows PowerShell.
In the Windows PowerShell window, enter CD and a space, select paste and then click the up button on your keyboard until you see the first half of the file path and select enter. It will look similar to:
CD C:\Users\(your name)\Desktop
On the next line, click the up button on your keyboard until you see the second half of the file path and select enter. It will look similar to:
& '.\GCP_Vault_Configuration.ps1'
On the Project ID line, enter a unique Project ID name.
ProjectId must be a unique string of 6 to 30 lowercase letters, digits, or hyphens. It must start with a lower case letter, followed by one or more lower case alphanumerical characters that can be separated by hyphens. It cannot have a trailing hyphen.
On the Service Account ID line, enter a unique Service Account name. You can use the same name as the Project ID, or use the same naming conventions.
Now, on the Output Path line, specify where the JSON Key and Log will be exported to on your computer (e.g. C:\CloudM GCPVaultConfig).
The PowerShell will run and provide the following details and manual instructions that you must carry out.
For Step 1 - Configure Google Workspace Domain Wide Delegation using the following ClientId and Scopes, copy the displayed URL in the PowerShell window and paste into a browser.
On the Security > API Controls > Domain-wide Delegation screen, select Add new to display the Add a new client ID pop-up box.
Copy and paste the Client ID and OAuth Scopes from the PowerShell window into the specified fields and select AUTHORIZE.
Now, in Step 2 - Service Account details for use in CloudM Migrate, copy the Service account email address that you need later when configuring the platform in CloudM Migrate.
The JSON key file that you will also need when configuring the platform in CloudM Migrate can be found in C:\CloudM\GCPVaultConfig, along with a gcp_vault log for the process.
Manual Method
For manual configuration of the GCP project, follow Google's service account creation guide to set up a service account and generate a JSON key file. Once you have the service account email and JSON key, proceed to the "Add service account(s) in Archive" section below.
2. Add service account(s) in Archive
In CloudM Automate, navigate to Archive > Vault Configuration.
Select + Add access key.
Upload the Service Account JSON key into the Service Account for Google Vault field.
Enter the email address of an administrator in the Admin email field.
Select Test Connection to check that connection has been successful.
Select Save.
The project name will be displayed, tabbed at the top of the screen.
To add multiple service accounts: Repeat this process for each additional service account (up to 5) to maximize your archival thread allocation and improve performance.
3. Add the Archive Vault step to your offboarding workflow
The following instructions assume that the Archive Vault step will be added to an existing offboarding workflow, and can be added in addition to the standard Archive step. Please refer to the Offboarding Workflows article on our Knowledge Base for more information on other steps that can be added.
To add the Vault Archive step to an offboarding workflow:
Sign into CloudM Automate.
Click on Automate > Offboarding Workflow
Select the Root Organizational Unit (listed at the top of the list and denoted with an office block icon) or a child OU listed below the Root OU.
If you want to apply the Archive Vault step to a Smart Team, select the Smart Team tab and click on the required Smart Team.
All child Organizational Units will automatically inherit the policy set from the Parent Organizational Unit unless you set an explicit Offboarding Policy.
Where the Organizational Unit is not the Root, select Explicitly set Offboarding Policy to edit the process for the selected Organizational Unit.
If you have selected a Smart Team, ensure that the workflow is set to Enable so that the policy will take precedence over the user's Organizational Unit policy.
Select Add Offboarding Step.
Navigate to the Archive Vault step and select the checkbox.
Select whether to archive emails, chat and / or drive documents by selecting the checkbox against the relevant setting. Mail and Drive are selected by default, but you will need to manually check the Archive chats option to enable Chat.
Select Add to Workflow.
The Archive Vault step will now appear in the workflow.