The question you cannot answer from the Admin console
"Is anything of ours public?" It arrives as a one-line email from the CEO, usually after a client mentions they found a document by accident. The honest answer for most Google Workspace admins is: I can check my own Drive in ten seconds, and for the other 140 people I have no button.
Here is every native method, exactly where each stops, and the one way to get a single list across the domain.
What "anyone with the link" actually means
Every Drive file has a General access setting. Google's own wording matters, because the three options are not the same risk:
– Restricted: "Only people with access can open the file." – Anyone with the link: "Anyone who has the link can use your file, without signing in to their Google Account." – Public: "Anyone can search on Google and get access to your file, without signing in to their Google Account."
"Anyone with the link" is not indexed by search engines, but the link is all that protects it. Forwarded once, pasted into a chat, left in a departed contractor's inbox – it still works. "Public" is discoverable. Publishing to the web is a separate action again, and depends on your organisation's settings.
None of these is tied to a person. There is no external email address to search for, which is what makes public links harder to find than ordinary external shares – those are covered in the external sharing report guide.
Method 1 – each user searches their own Drive
Drive search understands sharedwith:public owner:me. It lists the files the signed-in user owns that are shared with anyone with the link or public. Drive's filters do the same without the syntax: open the People filter chip and choose "Anyone with the link" (Stanford University IT documents this route for its users).
It works, and only for the person typing it. There is no domain-wide version an admin can run across other users' Drives. You can email the instructions to everyone and ask for replies. Some people will do it; you will not know what the others missed, and you will have no record.
Method 2 – the Drive log's Visibility change filter
Menu → Reporting → Audit and investigation → Drive log events. Add a search condition on the Visibility change attribute – Google defines it as "visibility of the Drive item before the activity". It is an attribute, not an event name: Google's Event name list is View, Rename, Create, Edit, Print, Delete, Upload and Download, with no discrete sharing event, so look for Visibility change in the attribute list. Rows also carry Prior visibility, Owner and Target ("user whose access is changed"), so a change to "anyone with the link" is visible.
Google documents a second, more direct recipe for the external half of the question: Add a filter → Visibility → select Shared externally → Search. One caveat comes with it, in Google's own words: if you turn off external sharing and a user shares with a group that allows external users, the data is still marked Shared externally in the log – "you'll see this even if the group doesn't have any external users". Expect some false positives on that filter.
Three limits, all documented by Google. The default view is the last seven days, so widen the date range deliberately. Drive log events are retained for six months, so anything made public earlier is gone. And the log records changes inside the window, not what is public now: a file shared with a link in 2024 and untouched since never appears; a file made public last week and restricted yesterday appears twice. You can export to Sheets or CSV (capped at 100,000 rows) as evidence, but it is still a list of events. People opening a public link show as "anonymous" unless the file was explicitly shared with them, so the log can tell you an outsider viewed something without telling you who.
Method 3 – sharing settings are a control, not a list
Menu → Apps → Google Workspace → Drive and Docs → Sharing settings → Sharing options. External sharing is Off, Allowlisted domains only, or On, and can differ per organisational unit. With sharing on, Google says you have "options to limit sharing, such as warning users before they share or blocking link sharing".
Two things this page will not do. It will not tell you which files are public now – it is a policy, not an inventory. And its effect on existing links is not uniform: Google states that when external sharing is turned Off, "external users also lose access to any items previously shared with them", but for the other options the help page does not say what happens to links already in circulation, so check before relying on it. Changes can take up to 24 hours. Most organisations cannot turn external sharing Off anyway; clients need their access.
Method 4 – the file exposure report, if your edition has it
The file exposure report shows sharing methods over time, frequently viewed shared files and the outside domains files are most often shared to, with up to an 80-minute delay. It is on Frontline Plus, Enterprise Plus, Education Standard and Plus, and Enterprise Essentials Plus. Drive inventory export goes further – file metadata including who each file is shared with, exported to BigQuery – on Frontline Plus, Enterprise Standard and Plus, Education Standard and Plus, Enterprise Essentials Plus and Cloud Identity Premium, once you have a BigQuery project with billing.
On Business Starter, Standard or Plus, neither exists. One thing you do get on Business Standard and Plus is the quarterly data protection insights report (Menu → Security → Access and data control → Data protection), which counts Drive files with sensitive content shared externally and breaks them down by sharing method, public links included – a trend line rather than the list of files, and only for content matching Google's default detectors. That is where Google stops; the whole gap is in the reports your Workspace edition doesn't include.
Method 5 – scan the whole domain once
Drive Guard for Admins is installed once by a Workspace admin from the Google Workspace Marketplace and deploys to every user; nobody installs anything themselves. It scans every user's My Drive and every Shared Drive in the organisation and puts public links, external shares and legacy access on one dashboard, with exports. The public-links view is the answer to the CEO's email: every public link across the organisation in one list you can hand over.
Be clear about what it does today. It reports; revoking a link from inside the tool is on the roadmap, not live. You fix each file in Drive, yourself or by sending owners their rows from the export. The cadence is yours – it runs when you run it.
What to do with the list
Sort by owner, then last modified. Files nobody has touched in a year with a live public link are the easy restricts. Anything in a Shared Drive gets its own pass, because the file belongs to the drive rather than a person, and its managers have to decide. Record what you restricted and what you kept with a reason, and put the next audit date in the calendar. The full method, including the Shared Drive and leaver checks, is in how to audit Google Drive access across the organisation.
Sources
- Share files from Google Drive – General access options and the verbatim definitions of Restricted, Anyone with the link and Public; publishing depends on account settings.
- Drive log events – Admin console path; default view last 7 days; Visibility change, Prior visibility, Owner and Target attributes (Visibility change is an attribute, not an event name); the documented "View files shared outside of a domain" recipe (Add a filter → Visibility → Shared externally) and its group false-positive caveat; external users shown as anonymous; export to Sheets/CSV capped at 100,000 rows; security investigation tool edition list.
- Data retention and lag times – Drive log events retained 6 months.
- Manage external sharing for your organization – Sharing options path; Off / Allowlisted domains / On; per-OU; "options to limit sharing, such as warning users before they share or blocking link sharing"; "External users also lose access to any items previously shared with them" (Off); up to 24 hours to apply.
- File exposure report – edition list, what it shows, up to 80-minute delay.
- Export your organization's Drive inventory – edition list, BigQuery, metadata incl. who files are shared with.
- Find files shared with "anyone with a link" (Stanford University IT) – the People filter chip → Anyone with the link route.
- Google Drive search operators –
sharedwith:publicandsharedwith:externaldocumented values;owner:documented as an operator. Re-read 2026-09-09.