How to Audit Permissions via Google Admin Console

In enterprise Google Workspace environments, unmonitored file sharing can lead to data leaks, over-provisioned privileges, and orphaned sensitive data. Users frequently share subfolders with external vendors, promote colleagues to Manager roles without oversight, or leave confidential Shared Drives accessible to former project members. Auditing permissions through the Google Admin Console provides system administrators with centralized visibility to inspect access lists, adjust permissions without end-user involvement, and enforce organizational security baselines.

Quick Answer

To audit Shared Drive permissions, sign in to the Google Admin Console, go to Apps > Google Workspace > Drive and Docs > Manage shared drives, select a drive, and click Manage members. For domain-wide reports, run an investigation query under Security > Security center > Investigation tool filtering by Drive events.

---

Why Console Auditing Is Necessary

Auditing permissions from the administrative level avoids the blind spots of the standard Google Drive web interface:

• Visibility Across All Drives: Administrators can view and manage Shared Drives even if they are not explicitly added as members.
• Hidden & Archived Assets: Reveals drives hidden by users or unindexed in local clients. See Troubleshooting “Hidden” Shared Drives.
• Compliance Enforcement: Verifies whether external sharing, download restrictions, and access boundaries adhere to company standards.

---

Method 1: Direct Shared Drive Member Auditing

For targeted audits of specific departments or sensitive projects, use the direct management interface:

1. Sign in to admin.google.com as a Super Administrator or delegated Drive Administrator.
2. In the left navigation menu, go to Apps > Google Workspace > Drive and Docs.
3. Click Manage shared drives.

Admin Console Navigation:
[Admin Console Home]
       │
       ▼
[Apps] ──> [Google Workspace] ──> [Drive and Docs]
                                         │
                                         ▼
                             [Manage shared drives]
                                         │
                 ┌───────────────────────┴───────────────────────┐
                 ▼                                               ▼
     [Direct Member Review]                          [Drive Settings Audit]
  (Click Drive > Manage members)                 (Check External Access / Policies)

1. The table displays every Shared Drive across the tenant, showing:
   • Name
   • Storage used
   • Status (Active vs. Deleted)
   • Organizational Unit (OU)
2. Hover over a Shared Drive and click Manage members.
3. Review the list of assigned users and groups:
   • Confirm that only authorized personnel hold the Manager role.
   • Look for unexpected personal email addresses (@gmail.com) or external contractors.
   • If an unauthorized user is present, adjust their role or click Remove directly from this panel.

---

Method 2: Enterprise-Wide Audits via the Security Investigation Tool

For organizations licensed under Google Workspace Enterprise Standard, Enterprise Plus, or Education Plus, the Security Investigation Tool (SIT) allows you to run comprehensive domain-wide permission queries.

How to Run a Permissions Audit Query:

1. In the Admin Console, navigate to Security > Security center > Investigation tool.
2. Click the Data source drop-down and select Drive log events.
3. Define your search parameters:
   • Condition 1: Event equals User access change (or Shared drive membership change).
   • Condition 2: Date within the target audit window (e.g., past 30 days).
   • Condition 3 (Optional): Visibility equals Shared externally.
4. Click Search.

Investigation Tool Output Example:
┌──────────────┬──────────────────┬─────────────────┬──────────────────────────┐
│ Timestamp    │ Actor            │ Event           │ Target Resource          │
├──────────────┼──────────────────┼─────────────────┼──────────────────────────┤
│ Oct 12 14:02 │ admin@domain.com │ Member Added    │ Finance Shared Drive     │
│ Oct 12 15:30 │ user@domain.com  │ Role Changed    │ Q4 Projections (Manager) │
│ Oct 13 09:15 │ lead@domain.com  │ External Share  │ Vendor Contract.pdf      │
└──────────────┴──────────────────┴─────────────────┴──────────────────────────┘

The resulting table provides an immutable forensic record showing who modified permissions, when the change occurred, and which accounts gained access.

---

Method 3: Auditing Drive Sharing Settings Across Organizational Units

Shared Drive security often fails because baseline policies at the Organizational Unit level are configured incorrectly.

1. Navigate to Apps > Google Workspace > Drive and Docs > Sharing settings.
2. In the left panel, select your target Organizational Unit.
3. Verify the following parameters:
   • Sharing outside of [Organization]: Verify whether external sharing is set to OFF, Allowlisted Domains, or ON. For policy troubleshooting, see Why Shared Drive External Sharing is Blocked.
   • Shared drive creation: Check which users have permission to create new Shared Drives. Restricting creation to IT prevents uncontrolled drive sprawl.
   • Access restrictions: Verify whether “Prevent non-members from accessing files” is enforced. If enabled broadly, it can break routine collaboration; see Why “Prevent non-members from accessing files” is breaking flow.

---

Administrative Remediation Next Steps

If an audit uncovers permission drift or misconfigured access:

• Demote Over-Privileged Users: Downgrade unnecessary Managers to Content Managers or Contributors using Fix: “Manager” vs. “Content Manager” Conflict.
• Investigate Orphaned Access: If managers have been removed from a Shared Drive entirely, use the Admin Console to assign a new Manager to avoid access lockouts, as covered in Fix: “Access Denied” on Shared Drive (Even for Managers).
• Standardize Administrative Reviews: Incorporate these steps into your regular security review cycle using The Shared Drive Security Audit Checklist for Admins.