The question every Workspace admin eventually gets
Someone senior asks it in one sentence: "Can you tell me what's shared outside the company?" And the honest answer, on most Google Workspace editions, is: partly.
Google gives admins real tools here, and this guide starts with them – what they answer, and exactly where they stop on your edition. Then it covers how to get the rest of the way to a complete answer.
What the Admin console gives every admin: the Drive log
Open the Admin console and go to Menu → Reporting → Audit and investigation → Drive log events. This is Google's record of Drive activity: views, edits, downloads, uploads, deletions, and – the part that matters for access auditing – sharing and permission changes.
It is genuinely useful, and it answers questions shaped like "what happened?": who changed the sharing on this file, when a document was downloaded, which user made a file public last Tuesday.
What it does not answer is the question you were actually asked, which is shaped like "what is the state right now?" A log of sharing events is not a list of what is currently shared. A file made public in 2023 by someone who has since left generates no new events at all – it just sits there, public.
Where the deeper tools are gated by edition
Google's answer to the state question exists, but read the small print on your edition:
- The security investigation tool – the version of the log that lets you pivot, group and act in bulk – is limited to Frontline Standard and Plus, Enterprise Standard and Plus, Education Standard and Plus, Enterprise Essentials Plus and Cloud Identity Premium. Business Starter, Business Standard and Business Plus are not on the list.
- The file exposure report is narrower still: Frontline Plus, Enterprise Plus, Education Standard and Plus, and Enterprise Essentials Plus only.
If your organisation runs on a Business edition – which is most small and mid-sized companies – the built-in path to "show me everything that is exposed" is not part of your plan.
The free per-user trick, and why it does not scale
Google Drive's search box documents a sharedwith: operator with two special values: sharedwith:public owner:me and sharedwith:external owner:me. Any user can run those on their own Drive, and it is a genuinely good five-minute self-audit – we cover it in detail in our single-user audit guide.
But note the phrase their own Drive. As an admin you cannot type that search on behalf of your 200 users. The operator scales exactly as far as your patience for asking 200 people to run a search and screenshot the results.
The org-wide audit
This is the job Drive Guard for Admins was built for. One admin install from the Google Workspace Marketplace deploys it to every user in the organisation – nobody has to install anything themselves – and the admin space scans across all users' My Drives and Shared Drives and puts the results on one dashboard: external access, public links and legacy access, exportable when someone asks for the report.
It is US$4.80 per user per year – launch pricing against a US$8.80 list price – with a 7-day trial (credit card required) so you can run a real audit on your own organisation before paying. Education institutes use it free, and organisations with more than 100 users get a discount.
A sensible audit cadence
- Run the org-wide scan and export the baseline.
- Fix the worst first: public links on anything sensitive, then external shares nobody can explain.
- Re-run after offboardings and at a regular interval, and compare against the baseline.
The first audit is the eye-opener. The second one is the security posture.
Sources
- Drive log events – menu path, event names, Visibility change attribute. Re-read 2026-09-09.
- File exposure report and the security investigation tool edition list on the Drive log events page – both re-read 2026-09-09.
- Google Drive search operators –
sharedwith:externaldocumented as "Find items explicitly shared with users or groups outside your Google Workspace organization";sharedwith:publicandowner:also documented. Re-read 2026-09-09.