Data Export Abilities

[Bryan Clarke]

I am looking to create a workflow that exports a users email before offboarding them. We delete users at offboard and do not currently use archived user licensing.

Using the Data Export feature in google admin, the data is placed in a google provided GCS bucket for 60 days. 

I am exploring what options I have to use gam to initiate this export, followed by copying the finished export to a shared google drive (or possibly another organization controlled GCS bucket for longer retention.

I do see that there are abilities to export from Vault. Does the ability to use the export data method in the admin console currently exist with GAM advanced?

[Paul Ogier]

Bryan,




I don’t think it does. The Data Export tool in the Admin console has no public API behind it, so there is nothing for GAM to call. Vault is the export path that does have an API, and that is the one GAM covers. Happy to be corrected if someone has found otherwise.




For what you are describing you may not need the console export at all. If the goal is a copy of the leaver’s mail and Drive that you control and that outlives the 60 days, the per-user route gets you there: GYB backs the mailbox up to local disk (or a mounted bucket) and can restore it into a successor’s mailbox under a Migrated/<user> label, and GAM’s data transfer moves Drive and calendar ownership to a successor. If you want the files in your own GCS bucket rather than in someone’s My Drive, rclone copies them out.




I maintain a free script that chains that whole sequence, written for exactly your case of deleting rather than paying for an archived user: pre-flight snapshot of the user’s state to JSON, GYB mail backup and migration, Drive and calendar transfer, group and delegate cleanup, licence removal, forwarding and auto-reply, suspension last so nothing is locked before the transfers finish. Apache 2.0, dry run by default until you pass –doit, GAM7 and Python 3. https://github.com/PaulOgier/GAMScripts




One caution given you delete rather than suspend: verify the successor actually has the mail and the files before the delete, not after. The script has a –scorched-earth flag that deletes the account and skips every data transfer phase, so it is not a “delete and migrate” button despite reading like one