1

Our company uses GSuite and has over 20 separate Shared Drives for various departments in the company. This causes an IT nightmare whenever we need to revoke access to someone such as a consultant who is outside the organization, as it is necessary to go into each of these 20+ drives and check if that person has permissions in that drive which needs to be removed. It's also possible that they have additional permissions one specific files.

This has been mitigated somewhat by creating groups granting the group permissions, then it is only necessary to remove the person from the groups they are in. However, this doesn't really help for people who have special permissions that cannot be generalized to more than one place; greating groups would only move the problem into have to search 20 or so groups to see if the user is a member of any of those groups. I tried going to the Groups page and simply searching for the e-mail address of a random person in one or more groups who happened to be outside the organization, and it says my search did not match anything when I typed the e-mail into the search bar on that page that says "Search for users, groups or settings".

So I'm looking for a more manageable way to identify everywhere in our Shared Drives that a user has been granted permissions, whether it's on the Drive itself, or specific documents in the drive. How can I do this?

Improve this question

1 Answer 1

Reset to default
0

I don't exactly know what you were trying to achieve when going to the group page and typing the email address but for sure is not the way to go. Groups are for sending emails of subscribe /unsubscribe bunch of email addresses all in once.

If I understand correctly your questions, you can see the subscription of each Shared drive by going in the Admin console admin.google.com as a Super Admin and then:

Apps > G Suite > Settings for Drive and Docs > Manage shared drives.

Once there, hover on top of a Shared Drive and press 'Manage Members.'

However if you want also a list that includes also files/folders from My Drive included, then you may want to implement a Drive API. These guides may be interesting:

-- Retrieve all permissions for a file, folder, or shared drive: https://developers.google.com/drive/api/v3/manage-sharing

Improve this answer
6
  • It takes way too much time to go through "Manage shared drives" 20+ times to remove a user from up to all 20 drives. Using Groups is a workaround so that for most employees it's only necessary to remove them once, from the group.
    – Michael
    Commented Jul 27, 2020 at 18:49
  • Yes that's a great way to use groups indeed.
    – Federico Baù
    Commented Jul 27, 2020 at 20:49
  • still doesn't handle the case of per drive specific permissions, so it's still necessary to search through 20+ groups to see if a departing user is in any of them.
    – Michael
    Commented Jul 27, 2020 at 22:25
  • Yes in fact in my first response I did state that Groups are meant for : 'Groups are for sending emails of subscribe /unsubscribe bunch of email addresses all in once.' Which is already what you are doing. A part of the solution I offered, if they user are internal you can check in admin console > Users >[User name]> Shared drives but I understand are external. So there isn't a straight configuration that allows u to do that. However if I were you I would create a simple workaround. Just you a Google Sheet and manually update it once you give/remove permissions, you can use some template
    – Federico Baù
    Commented Jul 28, 2020 at 5:00
  • 1
    Otherwise you may want to implement a little app with the Drive API.Check this post out: List all shared users of a particular presentation/doc on Google drive: stackoverflow.com/questions/14397910/…
    – Federico Baù
    Commented Jul 28, 2020 at 5:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.