# Audit Google Drive Access Across Your Organisation – Admin Guide > What the Google Admin console shows you about Drive access, where it stops on your edition, and how to see every user's shares – public, external and stale – in one audit. - Source: https://www.8apps.co/blog/audit-google-drive-access-across-organisation - Markdown: https://www.8apps.co/blog/audit-google-drive-access-across-organisation.md - Published: 2026-09-09 - Author: 8apps Team - Language: en --- ## The question every Workspace admin eventually gets Someone senior asks it in one sentence: "Can you tell me what's shared outside the company?" And the honest answer, on most Google Workspace editions, is: partly. Google gives admins real tools here, and this guide starts with them – what they answer, and exactly where they stop on your edition. Then it covers how to get the rest of the way to a complete answer. ## What the Admin console gives every admin: the Drive log Open the Admin console and go to **Menu → Reporting → Audit and investigation → Drive log events**. This is Google's record of Drive *activity*: views, edits, downloads, uploads, deletions, and – the part that matters for access auditing – sharing and permission changes. It is genuinely useful, and it answers questions shaped like *"what happened?"*: who changed the sharing on this file, when a document was downloaded, which user made a file public last Tuesday. What it does not answer is the question you were actually asked, which is shaped like *"what is the state right now?"* A log of sharing events is not a list of what is currently shared. A file made public in 2023 by someone who has since left generates no new events at all – it just sits there, public. ## Where the deeper tools are gated by edition Google's answer to the state question exists, but read the small print on your edition: - The **security investigation tool** – the version of the log that lets you pivot, group and act in bulk – is limited to Frontline Standard and Plus, Enterprise Standard and Plus, Education Standard and Plus, Enterprise Essentials Plus and Cloud Identity Premium. **Business Starter, Business Standard and Business Plus are not on the list.** - The **[file exposure report](/blog/google-drive-reports-your-workspace-edition-doesnt-include)** is narrower still: Frontline Plus, Enterprise Plus, Education Standard and Plus, and Enterprise Essentials Plus only. If your organisation runs on a Business edition – which is most small and mid-sized companies – the built-in path to "show me everything that is exposed" is not part of your plan. ## The free per-user trick, and why it does not scale Google Drive's search box documents a `sharedwith:` operator with two special values: `sharedwith:public owner:me` and `sharedwith:external owner:me`. Any user can run those on their own Drive, and it is a genuinely good five-minute self-audit – we cover it in detail in [our single-user audit guide](/blog/drive-guard-audit-google-drive-access). But note the phrase *their own Drive*. As an admin you cannot type that search on behalf of your 200 users. The operator scales exactly as far as your patience for asking 200 people to run a search and screenshot the results. ## The org-wide audit This is the job [Drive Guard for Admins](/google-workspace/drive-guard-for-admins) was built for. One admin install from the Google Workspace Marketplace deploys it to every user in the organisation – nobody has to install anything themselves – and the admin space scans across all users' My Drives and Shared Drives and puts the results on one dashboard: external access, public links and legacy access, exportable when someone asks for the report. It is US$4.80 per user per year – launch pricing against a US$8.80 list price – with a 7-day trial (credit card required) so you can run a real audit on your own organisation before paying. Education institutes use it free, and organisations with more than 100 users get a discount. ## A sensible audit cadence 1. Run the org-wide scan and export the baseline. 2. Fix the worst first: public links on anything sensitive, then external shares nobody can explain. 3. Re-run after offboardings and at a regular interval, and compare against the baseline. The first audit is the eye-opener. The second one is the security posture. ## Sources - [Drive log events](https://knowledge.workspace.google.com/admin/reports/drive-log-events) – menu path, event names, Visibility change attribute. Re-read 2026-09-09. - [File exposure report](https://knowledge.workspace.google.com/admin/security/file-exposure-report) and the security investigation tool edition list on the Drive log events page – both re-read 2026-09-09. - [Google Drive search operators](https://support.google.com/drive/answer/2375114) – `sharedwith:external` documented as "Find items explicitly shared with users or groups outside your Google Workspace organization"; `sharedwith:public` and `owner:` also documented. Re-read 2026-09-09.