domainwidedelegation.comStart free

Use cases → Documents and Drive

Audit cross-domain file sharing in Google Drive

Detect and report files shared outside the organisation using delegated access, so admins can act before data leaks escalate.

Who it is forSecurity and compliance teams responsible for data governance.
APIsDrive API, Admin SDK
Typical scopesdrive, admin.directory.user.readonly

The problem

Drive sharing links and explicit permissions can expose data to external accounts without visibility in the admin console. Regular audits are needed to spot accidental or risky external shares.

How it works

  1. Enumerate all users in the tenant using the Admin SDK.
  2. Impersonate each user via domain-wide delegation to list their owned files with the Drive API.
  3. For each file, inspect permissions for external users or link sharing beyond the domain.
  4. Aggregate and report findings, flagging files with risky or unintended external access.

What changes

Admins gain concrete evidence of externally exposed files and can remediate before incidents occur.

The trap in this one. Drive API's permissions list can lag actual sharing state by several minutes, especially after bulk changes; an audit run immediately after a mass permission removal may report false positives. Files owned by suspended users aren't reliably discoverable with the same queries, so gaps appear unless you explicitly include them.

Questions people ask

Does the Drive API show all file shares instantly?

No; permission changes can take minutes to propagate to the Drive API, so an immediate audit won't reflect the latest state.

What about files owned by suspended or deleted users?

Standard listing calls skip suspended users unless you explicitly include them. Always query for these accounts or you'll miss exposures.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Reassign Drive permissions in bulk with delegation

Use a delegated service account to change or transfer Drive file permissions at scale, for user transitions or access audits.

Bulk remove external sharing from Drive files

Audit and revoke third-party access to Drive files in bulk using a service account, to close off lingering external shares after projects or audits.

Automatically remove ex-employees from Shared Drives

Use delegated automation to ensure former staff are promptly and reliably removed from all Shared Drives they could access.