How to Audit Google Workspace Permissions Before a Security Review
When a security review lands on the calendar, the same question comes up first: who can access what across Google Workspace, and why. Most ops and IT teams don't have a clean answer on hand, because access builds up quietly — a shared folder here, a group added to a Shared Drive there — until nobody can say with confidence who can see what. Learning how to audit Google Workspace permissions before the reviewer asks turns that scramble into a routine check you run on your own schedule, not theirs, and it's far less painful than reconstructing months of sharing history under deadline.
Why This Can't Wait for the Reviewer to Ask
A reviewer's first request is almost always an access inventory: every Shared Drive, every external share, every app connected to the domain. If you're pulling that together for the first time under deadline, you will miss things — an old contractor account still sitting in a group, a Drive shared with anyone who has the link from three years ago, a departed employee whose files nobody reassigned. That's exactly why teams that audit Google Workspace permissions on a regular schedule rarely get surprised by a review, and why building the habit early is what makes the actual review fast instead of frantic. It also gives you a defensible answer when someone asks how long a given access grant has existed, instead of a guess.
Start in the Admin Console, Not Individual Drives
Checking one person's Drive sharing settings tells you almost nothing about organizational risk. The real picture lives in the Admin Console: Reporting for sign-in and admin activity, Security for access and data control, and Groups for who belongs to what. Start there, then drill into specific Shared Drives once you know which ones carry the most exposure. A ten-minute pass through these three sections will usually surface more risk than an hour spent clicking through individual folders.
How to Audit Google Workspace Permissions Step by Step
Pull the external sharing report (Admin Console, Reporting, Manage domain sharing) and list every file shared outside your domain.
Review Shared Drive membership: who holds Manager and Content Manager roles, not just who can view, and whether that list still matches your current team.
Check third-party app access under Security, API controls, and flag anything with broad Drive scope nobody remembers approving.
Audit group ownership, especially groups anyone can join or post to, and confirm distribution groups aren't quietly granting file access.
Confirm every offboarded account is fully suspended, not just removed from its team's Shared Drives, since group membership often survives an offboarding checklist.
The Sharing Settings Reviewers Always Flag
Two settings account for most audit findings: files or folders shared as “anyone with the link,” and Shared Drives where Manager access was granted broadly instead of to a small, named group. Neither is automatically wrong, but a reviewer will ask you to justify each one individually, so it's faster to fix the obvious cases before the review than to explain them during it. Public-link files tied to a form submission or an old marketing campaign are the most common false alarm, but they still take time to track down and clear one by one.
Common Gaps a Manual Audit Misses
Even a careful manual pass misses orphaned files with no parent folder, permissions inherited from a deleted group, and shares that predate anyone currently on the team. None of these show up in a folder-by-folder walkthrough, because there is no folder to walk through. They only surface in a full-domain scan, which is also the only reliable way to confirm that what you found really is everything, rather than everything you happened to click into.
A once-a-year scramble to audit Google Workspace permissions doesn't hold up as your team grows. NeatDrive scans every Shared Drive and My Drive automatically, flags risky sharing settings, and gives you a standing audit trail your next reviewer can actually use. Start a free audit at app.neatdrive.net.
Comments