domainwidedelegation.comStart free

Use cases → Documents and Drive

Monitor external file sharing from a single point

Aggregate and track all files shared outside the domain using a delegated service account, surfacing new exposures as they happen.

Who it is forIT security teams responsible for controlling data leakage across multiple Workspace users.
APIsDrive API, Admin SDK
Typical scopesdrive.readonly, admin.directory.user.readonly

The problem

Files are shared externally by users without oversight, and existing Drive audit tools only show a partial view when run per user. Centralised reporting is needed to catch new exposures quickly and reduce the window where sensitive documents are accessible outside the organisation.

How it works

  1. Use a delegated service account with domain-wide authority to impersonate users.
  2. Enumerate all active users via the Admin SDK.
  3. For each user, walk their Drive and collect permissions on each file.
  4. Aggregate and flag files shared with external email addresses or with link sharing enabled.
  5. Alert or report new external shares on a regular schedule.

What changes

Admins see a unified, up-to-date list of externally shared files across the whole domain, allowing rapid response to unwanted exposures.

The trap in this one. The Drive API’s permissions list endpoint can silently omit inherited permissions from shared drives, especially when files are moved or permissions are changed in quick succession. This means your monitoring may miss exposures if you rely on the first returned result set — always re-poll after suspected changes, and cross-check with the activity log to confirm exposure status.

Questions people ask

Can this approach detect public link sharing as well as specific external invites?

Yes, both direct external email shares and files with 'anyone with the link' access are detectable by enumerating permissions. You need to explicitly check for 'anyone' and 'anyoneWithLink' roles.

How often should the monitoring run?

Hourly is typical for sensitive domains, but the right interval depends on your risk tolerance and Drive activity volume. More frequent polling can hit API quota limits.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Rotate Drive access for external collaborators via automation

Regularly expire and re-grant Drive file access for external users without manual intervention or missed revocations.

Enforce Drive storage quotas on a schedule

Identify and act on users who exceed Drive storage limits by scanning usage periodically and triggering clean-up or escalation.

Migrate Drive data between teams with delegated access

Move shared Drive content for a whole team between organisational units or domains, preserving permissions and structure with a delegated service account.