Home‎ > ‎


Frequently Asked Questions and Answers

Archiving | Calendar | Contacts | Drive | Email Encryption


What will be the process for "ediscovery" if the agency chooses the basic option without Vault?  

The individual is responsible for keeping records. If your agency did not opt to use Vault, you would need to keep records in your mailbox or export to .PST.

What are the avenues to access user emails records?

In the Gmail environment, agencies have three routes to access user email records: 
  1. Agency-wide or user specific searches via Google Vault

    For agencies with business, enterprise or basic+Vault licenses, agency Vault administrators can access these records via the Vault web interface. Vault includes all emails that pass through a user's mailbox, even if they've been deleted from the Trash by the end user and have not expired based on retention policy. Note that only records for users who are subscribed to Vault can be accessed via this method. 

  2. Agency AITR request access to user's mailbox

    This can be accomplished by submitting a ticket to the VCCC. This would only provide access to email records currently in the user's mailbox. 
If an agency has Vault today and decides to go to the basic option without Vault, what happens to the messages that are already in Vault? 

If you are currently using Vault and switch to a basic mailbox without Vault, you will still be able to access messages that are in your mailbox only. Emails are deleted based on the retention periods that are set in Vault for those messages. 

If my Gmail inbox has Vault with a set retention period, what date does Vault choose to base the retention on? The date of the original email or the date the email was restored to Gmail?

It will be based on the date the original message was actually sent.  

Is Vault available for Google Drive?

Yes, Vault is available for Google Drive and can be configured with a different retention policy from email.

What is Google Vault?

Google Vault allows for retention, archiving, searching and exporting email. Your Trash folder is your Vault and is essentially your personal archive. Read more about Google Vault.

Can you exclude a user from Vault when a service level includes it?

There is no way to exclude a business or enterprise mailbox from Vault. While making the Vault retention a short duration will purge it from the Vault, it will also purge it from the mailbox.

Can the retention level be set by the individual or is it by agency?

Users at an agency can have different retention levels. The retention levels are set by the AITR/ISO on behalf of the user.

How do I name someone a Vault administrator at my agency?

Make this request using the COV Account Request form, Section 4. It will require ISO approval.

If I delete email from my Trash folder, can I recover it?

If you delete messages in Trash, the deleted messages will not be recoverable by you. However, if you have Vault, the messages will still be recoverable and under the same hold or retention rule within Vault. 

If delegated access to a user's mailbox is given, is the user notified?

No, when the agency adds/removes Vault administrators, the users are not notified.

If VITA is offering the basic option with and without Vault, why aren't the others offered in the same way?

Google doesn't offer business or enterprise licenses without Vault.

Can you exclude a user from Vault when a service level includes it?

There is no way to exclude a business or enterprise mailbox from Vault. While making the Vault retention a short duration will purge it from the Vault, it will also purge it from the mailbox.

What is the retention policy for Google Vault? Is it set up at the enterprise level or different for every agency?

Retention for Vault is set at the enterprise level for each agency. Retention periods are defined by LVA and determined by each agency's records retention needs.

Are Google domain administrators also Google Vault administrators?

Domain administrators are known as "Super Users." Our super users are the messaging supplier staff, who can see Vault data.

When I create a "matter" in Google Vault, who can I share it with?

You can share a matter with any other Vault administrator who has access to matters in your agency.

For a list of Google Vault resources, click here.


My calendar icon is missing, what do I do?

Open Gmail in Chrome, a app launcher icon will appear to the top-right of the page. Click the launcher and click More at the bottom of the list. Click Even more from Google on the bottom of that list. Scroll to the bottom of the page and click on Calendar. Your Calendar will open and click on the app launcher again. Add the Calendar shortcut once it asks you.

Can I book conference rooms and resources using Google Calendar?

Yes, to add a meeting room or other resource to an event:

  1. Sign in to your calendar and open the event
  2. If this is a new meeting, click a time in your calendar, and then click Edit event.
  3. If this is an existing meeting, click the name of the meeting in your calendar.
  4. On the right side of the event where you add guests, click the Rooms, etc. link
  5. Scroll through the list of resources to find the one you want. Or, start typing the name of the resource in the Filter room text box until the desired resource appears in the list. If you can't remember the full resource name, just enter any part of the name.
  6. Click Add next to the desired resource.
  7. The resource is added to the Where section in the Event details tab, and to the participants list in the Find a time tab. It is also listed in the Guests list.
  8. If you need to remove a resource you just added, find the resource in the Guests list and click the X beside it.
  9. Click Save.

Can I see a list of attendees who have accepted my invitation?

Yes, open the event details to see who has accepted your invitation.

Is there a limit to the number of people who can access a calendar?

No. You can share calendar access to an unlimited number of people.

Can I book multiple rooms at once?

Yes, you can book more than one room or resource for your event invitation.

Can I invite attendees from outside of my organization's domain?

Yes, you can send meeting invitations to any email address.

Can I invite a distribution list from our directory to a meeting?

Yes, you can invite any mailing list (group) in our corporate directory to a meeting. Each member of the group will receive an email invitation. Note, however, that the email invitation won't show all the members of the group. Also, the group members will appear in the invitation on each attendee's calendar only if you have permission to view the group's member list.

You can invite a Google Group to your event instead of inviting people one by one. Just follow the steps above and add the email address for the group. Learn more about inviting groups to your event.

What level of access do others have to my calendar?

By default, your calendar is shared with everyone in your domain, and they can see your calendar's free/busy information only. However, you can turn off calendar sharing.

If you share your calendar with everyone at your domain, you can specify whether they can see only free/busy information or all event details. You can also share your calendar with specific people and give them one of the following levels of access:

See free/busy information only

See all event details

Make changes to your calendar

Make changes and share your calendar with others - Make sure not to choose this option unless you specifically want this option.

If I create a calendar, can I remove it from my account and make it a shared calendar? Can I attach it to someone else's calendar?

To share duties for calendar administration, simply add additional owners of the calendar.

For a list of Google Calendar resources, click here.


If I add an external user to a distribution list in the COV Domain will it copy over as a contact for Google?

No, this will not create a contact in the directory for users to see. Anyone who has access to see the member list of that group can see the group members, but this does not add any contacts to the domain. 

Duplicate contacts

Scenario: A contact shows a vadoc.cov and a vadoc.virginia.gov email address. 

In your personal contacts, you may notice some legacy exchange email addresses you had listed in your Exchange contacts. These contacts may include email addresses with the "cov" or "local" domain names. You should remove these email addresses from your contacts if you do not wish to see them. See Removing contacts

Email Encryption

Will encryption be turned on in Gmail by default?
Data residing in Gmail is encrypted at rest but is not encrypted in a manner that will protect someone with access to the account from reading messages. To protect sensitive data, encryption must be enabled by using the approved add-on product, Virtru. 
Who can read encrypted email messages?
Inside the Gmail client, only the sender and the recipients can view an encrypted email using Virtru. 
Is Tempus Nova able to read COV-encrypted email messages?
No. If messages are encrypted with Virtru, Tempus Nova members are not able to read the contents of the message. They can, however, see the meta data, including subject, sender, and recipients of an encrypted email in the Virtru dashboard.

Will email data loss prevention (EDLP) be turned on in Gmail by default?
No, EDLP is not enabled by default. While EDLP is included in the cost of the unlimited storage mailbox option, you must inform VITA of what your EDLP requirements are so they can be configured for your agency. Refer to the pre-defined content filters listed here:  https://support.google.com/a/answer/7047475.


Does Virtru encrypt email external to COV end users as well as internal to COV end users or do we need to use S/MIME?

Virtru will encrypt messages to internal virginia.gov addresses as well as external addresses.

Can Virtru users send encrypted emails to distribution lists/Google Groups?

Yes. There are no special steps needed to use this capability. Simply add the distribution list/Group to the "To" field and you'll be able to send an encrypted email in the same fashion that you would send to an individual's email address. This capability is available to all Vitru licensed accounts. 
For more information on Virtru, click here.


How much space do I have for mail messages? 

Accounts will have either 30 gigabytes (GB) of storage or will be unlimited. Each agency will determine storage needs for users.

What happens if I reach my mailbox limit?

If you have a 30 GB mailbox and you reach the limit you should work with your agency to change to an unlimited mailbox. Note: There are additional costs associated with the unlimited mailbox. 

I synced my Gmail to Outlook and received a message stating that my mailbox is full.

If you have an unlimited mailbox in Google, please refer to the following link for instructions on how to increase the size of your local mailbox. https://support.google.com/a/users/answer/184126

Is there a size limitation for file attachments in Gmail?

Yes. When you're attaching files from your computer, you can only attach files up to 25 megabytes (MB) in size. 

Is there a type limitation for file attachments in Gmail?

Yes. To help prevent viruses, Gmail won't accept file attachments that are executable files (.exe). 

Is there a limit to the number of recipients in an email?

Yes; 2,000 recipients (500 external). See this guide for more information on Gmail sending limits.

How do I prevent messages from specific senders from being tagged as spam?

If messages from a sender outside your domain are being incorrectly tagged as spam, you can prevent this from happening by creating an email filter using the Never send it to Spam option:
  • In Gmail, click Settings > Filters > Create a new filter.
  • Enter the person's address in the From field, and then click Next Step.
  • Select Never send it to spam, and then click Create Filter.
How long do messages remain in my Spam folder?

Messages remain in the Spam folder for 30 days. After that, Gmail permanently deletes them. 

How do I move my compose window around if I don’t want it in the bottom right corner?

Hold the Shift key down and click Compose. 

Will my JAWS screen reader work in Gmail?

Based on feedback from agencies, JAWS with Outlook configured to connect to Gmail is the best option. Outlook is an available client for Gmail. To sync Gmail with Outlook, use G Suite Sync for Microsoft Outlook

If a shared mailbox is moved to a Google Group, will the associated calendar move with it? 

Google groups do not have calendars associated with them. The recommendation is to rebuild the calendar in Google as a shared calendar and share it out appropriately. This does require one user account to "own" the calendar, but multiple owners can be added afterwards.

For Gmail resources, click here.

Google Groups, Resource Calendars, and Shared Accounts


Can Group membership be forced, meaning users cannot leave a Google Group?

Yes, users cannot leave a Google Group unless removed by the Group's Owner or Manager.

How can I control which users can send emails to a distribution list?

Open a ticket with the VCCC to request send permissions for a distribution list.

How do I add a user directly to a Group?

Manage the members of a Group using COV Account Center. Click on "Manage My Groups" under "Group Management."

Can I turn off the conversation mode for a Group?

Yes, within the desired Google Group, select Manage > Information > Web View Customization.

If I receive a message from a Group in my inbox and reply from my personal inbox, does that also post to the Group?


What is the difference between a Web Forum and a Q&A Forum?

Can we send canned responses within Google Groups?

Yes, canned responses can be used in both the Google Mail and Google Groups interface. See this resource or additional information.

Can a user turn off the Groups notifications?

Yes, notifications can be disabled on a per user basis (Manage > Members > All Members > Actions > Change Delivery Settings), or you can create a filter within your inbox to automatically route those emails to a specified label.

Is there any way to tell that a message in a Google Group has been responded to, even if someone responds as an individual, and doesn't copy the Group?

Yes, the message will be marked as "Viewed" if it has been read by a different member. Once opened in the Google Group it will show as being read/unread ONLY for the user viewing. A reply all from Google Mail will add a response to the post, indicating to the other members that there has been a response.

Can a Google Group be accessed via a mobile device just like a shared account? Can a user have both their user account and a Google Group account accessible via a mobile device (tablet, smartphone, etc.)?

Google Groups can be accessed via mobile devices through the mobile browser only as there is no app available at this time. Alternatively, messages sent to a Google Group will also be sent to Google Mail which is accessible through the Gmail app on mobile devices.

Does a Google Group have its own calendar and email address?

Google Groups do have their own email addresses. A secondary calendar would need to be made and assigned to the Google Group.

Is there a way to see a list of members of a Google Group (distribution list)?

Yes, there is the ability to see the members of that distribution list. But please note, there are also settings to determine what user(s) should be able to see those members. So if you are apart of a Group and do not have permission to view the members of the Group (or distribution list), then you will not be able to view the members. 

To view members of a Group, click on the desired group from within Google Groups. On the top right side of the page, click "Members."

Once a request has been attended to in a Google Group, can the user delete the email?

Best practice would be to apply a tag or category to completed requests instead of deleting the email, as there is no way to recover deleted email from a Google Group.

Google Groups Quick Hints
  • Attachments - Google Groups do support attachments
  • External Emails - Google Groups do allow emails from external email addresses.  Group owners and managers have the ability to restrict this if necessary
  • Message Limit - Messages to a Google Group have the same 25 GB size limit
  • Mailbox Size Limit - The Google Groups user interface does NOT have a maximum size limit, unlike a user's mailbox or delegated mailbox, which is limited to 25 MB.


What is the benefit of a Google resource calendar versus a secondary calendar?

The benefit depends on how the calendar would be used. As a general rule, resource calendars should be used for reserving time and secondary calendars should be used to collaborate with a team such as team vacations or a project team calendar.

Does a Google Group have its own calendar and email address?

Google Groups do have their own email address. A secondary calendar would need to be made and assigned to the Google Group.

If a user creates the secondary calendar, and the user leaves the organization, what happens to the secondary calendar?

The calendar exists as long as other users have access to it.

Is a resource calendar required to have an owner?

No, an owner is not required for a resource calendar -- an owner is optional.

Additional Information

Google License True-up

Where can I find instructions on completing the true-up spreadsheet?

Instructions are found here.

Why do agencies have to select licensing for our messaging service now?

Our contract with our messaging service supplier allows for commonwealth agencies to renew their licenses and "true down" license requirements once per year. This is a great opportunity to ensure that your license consumption aligns with your business needs. 

We see there is a due date of April 3 for agencies to have their completed messaging license spreadsheet approved by the agency head and submitted to the VCCC. What happens if we do not submit the spreadsheet or submit it late?

The purpose of the due date of April 3 is to meet our contractual requirement to alert our messaging supplier of license changes, and to allow it to make the requested changes to be effective at the beginning of the new fiscal year (July 1). If changes are not submitted by April 3, your current license elections will carry over to the new contract year.

How do I turn in my completed messaging license spreadsheet?

Agencies should submit a VCCC request via email to vccc@vita.virginia.gov, no later than April 3. In that email, they should copy (cc) the following: agency head, business relationship manager, cam@vita.virginia.gov and messaginginfo@vita.virginia.gov

If I change my license type (e.g. move from an enterprise license to a basic license), will I lose any of my emails?

You will not lose any data from moving to another license type.

If I decide later that I need Google Vault, can that be added to my account?

Yes, additional costs apply.

If I decide later that I need to go back to unlimited, can I?

Yes, you can upgrade at any time, but additional costs apply.

Can I downgrade my license after July?

You can only downgrade licenses during the annual Google true-up period.

Previously, Virtru email encryption and Virtru Drive encryption were billed separately. Why is there only one Virtru service option available on this true-up?

Virtru email encryption and Virtru Drive encryption have been combined into one service offering. The combined service rate is the same as the individual Virtru rates and is more cost-effective for VITA and agencies.

Why are there certain services that are available on my billing sheet that are not available on this true-up spreadsheet?

The services listed are for the Google true-up. While other services are available, only these pertain to Google license renewal.

How do I know if a user needs an unlimited mailbox?

Agencies determine what mailbox size is sufficient for their individual users. You can always upgrade to an unlimited mailbox anytime throughout the year, but you cannot downgrade until the next annual true-up the following year.

Is VITA sunsetting hosted mail archiving (HMA)?

Yes, HMA (Veritas) services will be discontinued after March 31, 2020, and all associated data will be deleted after this date. Google Vault is available for mail archiving with all three mailbox offerings.

Mailbox License Service Type

Do "device management rules" affect our devices?

There is no impact to the agency regarding this feature.

What is the difference between business unlimited and enterprise unlimited? 

Here is a link to a chart that breaks down the differences.

What is the number of Hangouts participants for each level of service?

Basic: 100; Business: 150; Enterprise: 250

Advanced enterprise control and customization is not available in the business option. What does this component provide?

This option provides enhanced functionality for G Suite administrators. It does not impact agencies/users.
What is data regionalization? 

Data regionalization allows each agency to control whether their email data stays within the continental United States. This only applies to business and enterprise licenses.

Is S/MIME encryption necessary if we need to encrypt all email or does Virtru cover that need? 

Virtru covers that need. We do not have S/MIME enabled in G Suite because we do not want commonwealth certificates living outside of the internal domain.

Mobile Device Management

How do we set up an approval workflow for mobile device management (MDM)?

For a user to gain access to Google MDM, a request must be made through the COV Account Center. The form has a built-in workflow that includes agency approval before it is processed.

Will contacts be downloaded to my mobile device with the Google mobile device management app?

For Apple iOS - Yes, contacts will sync to the native contacts if the user so chooses.

For Android - Yes, contacts will sync to the work contacts folder.

What if I forget my password on my mobile device?

If you forget your password or PIN and lock yourself out of your phone, the help desk can factory reset your phone remotely. For iPhone users, once the phone has been reset you will need to use iTunes to recover the phone. Since iTunes requires administrator privileges and most users do not have this on their COV-issued device, your personal iTunes application will work to get your COV-issued phone back online. Android users will follow the standard phone setup procedures as displayed after the phone has been reset.

How do I read encrypted messages on my mobile device?

If you receive an encrypted email, you are presented with the option to choose to open it with your Google account or a web browser. Choose web browser. This will enable you to read and reply using Virtru.

Is there a way for an agency to unlock a commonwealth-issued Apple device when we do not have the original user's Apple ID? 
VITA can get activation locks removed from iPhones and most cellular Apple devices, depending on the wireless carrier. We need the mobile phone number last associated with the device and the mobile device serial number. Please contact SCMInfo@vita.virginia.gov

For more information on Mobile Devices, click here.


My agency has an application that uses POP3 for sending/receiving email. How do I integrate this with Gmail?

For more information, click here.

Shared/Group Mailbox and Distribution

Where can I learn about Google Groups?

Visit Google Groups, Resource Calendars and Share Accounts. Also see: Managing resources

Can I send from a shared mailbox as the mailbox name instead of "on behalf of" the mailbox?
Yes, contact the VCCC to request being able to "send as" the mailbox name. Indicate the name of the mailbox that users want to send as, and include the list of users who require the send as permission.

For example: Please assign "send as" permissions to the "example@vita.virginia.gov" shared mailbox to the following users: 

If a shared mailbox is converted to a Google Group, but then it is decided that it does not meet needs, can the Google Group be converted back to a shared mailbox?
Yes, but data will not be migrated.
How do I convert a shared mailbox to a collaborative inbox?

Will end users be able to create their own collaborative inboxes?

No, end users cannot create their own collaborative inboxes.

How do I manage agency distribution lists that I own?
You can manage distribution lists using the COV Account Center. See: Managing resources
If I am a member of a distribution list, and I send a message to that list, will I receive the email?
No, you will not receive the email, but a copy will be in your Sent mail.

How do I get named as an owner of an existing distribution list?
A ticket should be opened with the VCCC naming who should be added as owners. This request must have AITR or ISO approval. See: Managing resources

In Microsoft Exchange, distributions lists could be restricted to who could see them, who could send to them and if they were internal or externally reachable. Can Google allow for distribution list security?

Google doesn’t allow for distribution list security as described in the question.

My distribution lists are shown in Google Groups. Can I add and delete members via Google?

No, you cannot manage distribution lists in Google. If you make changes in Google, they will be overwritten when it syncs with Active Directory. Distribution list information resides in Active Directory. Changes must be made using COV Account Center (also known as Forefront Identity Manager). See: Managing resources

Using Google 

How do I create a shortcut on my desktop to Gmail?
  • Log into Gmail
  • In the Chrome browser, click on 3-dot icon in the upper right of screen
  • In drop-down menu, hover cursor over "More tools"
  • Select "Add to desktop" from side menu
How do I make "Contact us" or "Send to" links launch Gmail instead of Outlook?

Can I forward my Gmail to another address?

Yes, but because of security policy (SEC-501 MP-1-COV(5)) it requires agency head approval. Agencies must maintain the documented approval on file at the agency. The agency's information security officer should open a ticket with the VITA Customer Care Center to have the "Forwarding and POP/IMAP" tab installed in Gmail. The ticket must include the agency head's documented approval. Once the tab has been installed, forwarding can be set up by following these directions: Automatically forward Gmail messages to another account

VITA Messaging

Does VITA have service level agreements for messaging services?

Please see "SLAs" for a table of service level agreements and response times.

How do I request access to an employee's account who has left state service or is on extended leave?

How many people can have access to a disabled email account?

Up to 24 people can have access.

What happens to the Google license when an email account is disabled?

Licenses remain in effect on a disabled account. Licenses are only fully removed when an account is fully deleted.

My employee’s email account was already deprovisioned. Can I still request access to the mailbox?

Delegating access to an account can be done up to 90 days after an account has been deprovisioned. 

How do I prevent an email from being sent to Spam?

See "Whitelisting ("never send to Spam") an email address" on the Resources page.

Why can't I use Google Drive?

Google Drive is not part of the email service offering and does not meet commonwealth least privilege requirements in the current Gmail configuration. Users may see Google Drive as enabled in the case that an agency has opted in for the calendaring attachments feature. Drive may not be used for anything except calendar attachments. VITA is investigating methods to enable Google Drive for future use.

For employees who have left the agency, are we able to keep their account active indefinitely, or is there a timeout for when the email address is deleted?

If an agency wants to continue paying for a user's google mailbox/services who left that agency, then they can retain access to that account.


G Suite and related messaging services, including email, are part of the commonwealth’s new information technology infrastructure services provided by the Virginia Information Technologies Agency (VITA).