domainwidedelegation.comGet it set up

Use cases → Admin and governance

Control cross-domain sharing of Drive documents

Prevent sensitive Drive files from being shared outside your domain by auditing and revoking risky permissions through a delegated service account.

Who it is forWorkspace administrators responsible for data security and compliance.
APIsDrive API, Admin SDK
Typical scopesdrive, admin.directory.user.readonly

The problem

Users can share documents with external accounts, often bypassing internal policies. Manual audits miss files, and one-off fixes are quickly undone by new shares.

How it works

  1. List all users in the domain using the Admin SDK.
  2. For each user, enumerate their Drive files using the Drive API with domain-wide delegation.
  3. Identify files with permissions granted to external domains.
  4. Remove or restrict external permissions on flagged files.
  5. Notify owners about changed sharing settings to reduce confusion.

What changes

Unapproved external sharing is detected and remediated at scale, reducing the risk of data leaks and accidental exposure.

The trap in this one. Drive API’s permissions.list endpoint can silently omit inherited permissions from shared drives, especially if the service account is not a member of those drives. This means your audit will miss files shared via group membership or inherited settings, leaving gaps in your controls even if your script reports a clean bill of health.

Watch it explained

“Community Demo - Accessing Google APIs from SharePoint Framework solutions” — Microsoft Community Learning on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Does this work with shared drives?

Yes, but only if the service account is explicitly added as a member of each shared drive you want to audit. Otherwise, files in those drives may be skipped or incomplete.

Will users know if their external shares are removed?

Not by default. It's best practice to notify document owners after permissions are changed to avoid confusion and support tickets.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.

Reduce an over-broad delegation grant safely

Find out which scopes your automation genuinely uses, then cut the grant down to them.