domainwidedelegation.comStart free

Use cases → Documents and Drive

Finding Drive files shared with an external address

How to identify Google Drive files shared with a specific external email using domain-wide delegation, and the critical limitations you must handle.

Who it is forIT admins or security teams responsible for Drive data exposure reviews.
APIsDrive API, Admin SDK
Typical scopesdrive, admin.directory.user.readonly

The problem

When an employee leaves and starts using a personal email, you may need to check if any files remain shared with their new address. Google Drive doesn't provide a built-in way to search for files shared to arbitrary external addresses. Failing to identify these shares leaves data exposed to former staff or external parties.

How it works

  1. Use the Admin SDK to confirm the user's departure and obtain a list of all active users in the domain.
  2. For each user in the domain, use the Drive API to list all files they own, handling pagination and potential API rate limits.
  3. For every file retrieved, inspect the permissions array for grantees matching the departed employee's personal email address.
  4. Log or otherwise record any files where this external address appears in the permissions.
  5. Review and remove inappropriate shares as needed, and repeat periodically to catch new exposures.

What changes

You get a defensible, explicit list of files shared to the target external address, with documentation of your review. The process is slow and resource-intensive but necessary for thoroughness.

The trap in this one. Drive API does not allow you to directly query for files shared to an arbitrary external address. Even with domain-wide delegation, you must enumerate all files owned by users in the domain and inspect their permissions for each one—missing a single file or failing to paginate results will leave exposure undiscovered. There is no index or filter for 'shared with external email' in the API.

Watch it explained

“NEW Gemini in Google Workspace Updates for Docs, Sheets, Slides, Drive” — Tasia Custode on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Can I search Drive directly for files shared to an external address?

No. The Drive API doesn't support filtering or searching by external grantee. You must enumerate files and check each one's permissions.

How can I avoid missing files during enumeration?

Always handle pagination thoroughly, and ensure you process every user in the domain. Monitor for API errors and rate limits, and rerun as needed.

Is there a shortcut for large domains?

There is no supported shortcut. You can parallelise the enumeration, but you cannot avoid inspecting each file's permissions individually.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Rotate Drive access for external collaborators via automation

Regularly expire and re-grant Drive file access for external users without manual intervention or missed revocations.

Enforce Drive storage quotas on a schedule

Identify and act on users who exceed Drive storage limits by scanning usage periodically and triggering clean-up or escalation.

Migrate Drive data between teams with delegated access

Move shared Drive content for a whole team between organisational units or domains, preserving permissions and structure with a delegated service account.