domainwidedelegation.comStart free

Use cases → Documents and Drive

Rotate Drive folder access for changing team membership

Update shared folder permissions as teams change, using a delegated service account to enforce least privilege.

Who it is forWorkspace admins automating Drive access based on group membership.
APIsDrive API, Admin SDK
Typical scopesdrive, admin.directory.group.readonly

The problem

Manual folder permission management falls behind real team changes, leaving ex-members with access and new joiners unable to work. Automating permission updates is essential, but Drive's permission model and propagation can trip you up.

How it works

  1. Fetch the current group membership using the Admin SDK.
  2. List the folder's current permissions with the Drive API.
  3. Calculate the required adds and removals to match group membership.
  4. Apply permission changes in batches, minimising API calls.
  5. Log all changes and flag any permissions that could not be updated.

What changes

Folder permissions reliably reflect team membership, reducing both data leakage risk and onboarding friction.

The trap in this one. Drive API 'removePermission' calls on inherited permissions (from parent folders or groups) silently do nothing—no error, but no effect. If you don't explicitly check the 'role' and 'type' fields, you'll assume permissions are rotated when they're actually inherited and untouched. Always verify the directness of each permission before attempting removal, and never trust a successful response alone.

Watch it explained

“Google Cloud Professional Security Engineer Chapter 6 IAM Overview” — Jules of Tech on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

How often should permissions be rotated?

Daily is typical, but the real driver is the pace of team changes. More frequent runs are only worthwhile if group membership changes multiple times per day.

What about nested groups?

The Admin SDK does not expand nested groups automatically. You must resolve them yourself if your access model relies on nested group membership.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Reassign Drive permissions in bulk with delegation

Use a delegated service account to change or transfer Drive file permissions at scale, for user transitions or access audits.

Bulk remove external sharing from Drive files

Audit and revoke third-party access to Drive files in bulk using a service account, to close off lingering external shares after projects or audits.

Automatically remove ex-employees from Shared Drives

Use delegated automation to ensure former staff are promptly and reliably removed from all Shared Drives they could access.