Any domains with Google Vault enabled automatically generate 'vfe' (Vault Former Employees) users. When a customer needs to use Vault to store an ex-Google Apps user's data, they move the user to an OU called 'Former Employees'. This creates a new Google Apps user called 'firstname.lastname@example.org', for example... the actual email@example.com user is then deleted or suspended.
On our end, we also attempt to back up firstname.lastname@example.org. The backup fails (we backup no data), and the user is marked as disabled (or Archived, in the application), because the 'Former Employees' OU is seen as disabled. The customer has no option to enable the Former Employees OU on the Google Apps end because it does appear with the rest of the Google Apps OU structure.
But, the difference is that we have the backed up data covered email@example.com becomes an Archived user as well.
Most customers do not want these 'vfe' users backed up (because the data is already archived under the original account). As a workaround, we would recommend turning off (or having you turn off) the 'Former Employees' OU on the domain's auto-add settings, AND also bulk delete all of the 'vfe' users (Support can assist with either of those actions).
As a side note, for example, you may see that firstname.lastname@example.org is not in the database as an Archived user, but you do see email@example.com. That is usually because they were deleted from Google Apps before SaaS Protection/Backupify was set up (but the firstname.lastname@example.org user still existed in the Former Employees OU).
If you have any additional questions about 'vfe' users, please click here to submit a Support Request, or give us a call at (800) 518-7449 (USA) or +1 (475) 288-1818 (worldwide).