domainwidedelegation.comStart free

Use cases → Documents and Drive

Finding Drive files shared with an external address

How to identify Google Drive files shared with a specific external email using domain-wide delegation, and the critical limitations you must handle.

Who it is forIT admins or security teams responsible for Drive data exposure reviews.
APIsDrive API, Admin SDK
Typical scopesdrive, admin.directory.user.readonly

The problem

When an employee leaves and starts using a personal email, you may need to check if any files remain shared with their new address. Google Drive doesn't provide a built-in way to search for files shared to arbitrary external addresses. Failing to identify these shares leaves data exposed to former staff or external parties.

How it works

  1. Use the Admin SDK to confirm the user's departure and obtain a list of all active users in the domain.
  2. For each user in the domain, use the Drive API to list all files they own, handling pagination and potential API rate limits.
  3. For every file retrieved, inspect the permissions array for grantees matching the departed employee's personal email address.
  4. Log or otherwise record any files where this external address appears in the permissions.
  5. Review and remove inappropriate shares as needed, and repeat periodically to catch new exposures.

What changes

You get a defensible, explicit list of files shared to the target external address, with documentation of your review. The process is slow and resource-intensive but necessary for thoroughness.

The trap in this one. Drive API does not allow you to directly query for files shared to an arbitrary external address. Even with domain-wide delegation, you must enumerate all files owned by users in the domain and inspect their permissions for each one—missing a single file or failing to paginate results will leave exposure undiscovered. There is no index or filter for 'shared with external email' in the API.

Watch it explained

“NEW Gemini in Google Workspace Updates for Docs, Sheets, Slides, Drive” — Tasia Custode on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Can I search Drive directly for files shared to an external address?

No. The Drive API doesn't support filtering or searching by external grantee. You must enumerate files and check each one's permissions.

How can I avoid missing files during enumeration?

Always handle pagination thoroughly, and ensure you process every user in the domain. Monitor for API errors and rate limits, and rerun as needed.

Is there a shortcut for large domains?

There is no supported shortcut. You can parallelise the enumeration, but you cannot avoid inspecting each file's permissions individually.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Auto-provision shared drives for every new project

Spin up a new shared drive for each project, with the right permissions and structure, as soon as the project is created.

Automated monitoring for external sharing violations

Detect and report when Drive files or folders are shared outside the organisation using a delegated service account.

Automate project folder creation and access assignment

Create a Drive folder for each new project and assign the correct access immediately, without waiting for manual intervention.