Legacy Access: Drive Files Shared With Old Domains

The agency you stopped paying in 2024

The contract with the design agency ended two years ago. Their account manager has since moved to a competitor. She still has Editor on the brand folder, the pricing sheet you shared "just for the deck", and about forty other files, because nobody's last task on that project was to remove her.

This is legacy access: Drive permissions that were correct once and nobody revoked. It is not a breach and it rarely shows up in a log. It is the sum of every collaboration your organisation ever had, still live.

What legacy access looks like

Four kinds turn up in nearly every audit:

– Former agencies and consultancies – whole domains that had a reason to be in your Drive and no longer do. – Ex-clients – deliverables, proposals and working folders never closed out when the engagement ended. – Old vendors and contractors – often on personal Gmail addresses rather than a company domain, which makes them harder to spot. – Ex-staff's personal addresses – the file someone shared to their own Gmail to "work on it at the weekend", which survives suspension and, unless it is transferred, deletion. That case is in suspended is not gone and the wider offboarding checklist.

Why it accumulates

Shares outlive projects because nothing ends them. A project has a kick-off and rarely a close-out, and a share on a file is a per-file decision nobody revisits. The person who made it leaves; the drive is reorganised; the domain on the other end changes hands.

Google's tools do not surface it either, for documented reasons.

The Drive log (Menu → Reporting → Audit and investigation → Drive log events) records changes. A share created in 2023 and never touched generates no event this year, and Drive log events are retained for six months in any case. The log is activity history, not a current permissions map.

The sharing settings (Menu → Apps → Google Workspace → Drive and Docs → Sharing settings → Sharing options) govern what users may do from now on. Google documents one retroactive effect: when external sharing is turned Off, "external users also lose access to any items previously shared with them". For the Allowlisted domains option – the one most organisations actually use, adding a client domain when work starts – the help page does not say what happens to existing shares with a domain you later remove from the list. Do not assume; check whether existing shares are affected on a test file before treating the allowlist as a clean-up tool. Changes can take up to 24 hours to apply.

And the file exposure report, which shows the outside domains files are most often shared to, exists only on Frontline Plus, Enterprise Plus, Education Standard and Plus, and Enterprise Essentials Plus. On a Business edition you do not have it.

Hunting it by hand

Three native routes. None gives the whole picture; together they find most of it.

The Drive log, filtered. Add a search condition on the Visibility change attribute – it is one of Google's searchable attributes, not an event name – set the date range as wide as the six-month retention allows, and use the Target attribute (Google's definition: "user whose access is changed") to narrow to the address or domain you are hunting. Export to Sheets or CSV – capped at 100,000 rows. This finds shares made or changed in the last six months, and nothing older, which for legacy access is most of it.

Per-user search. Each user can type sharedwith:external owner:me into their own Drive search and see the files they own that are shared outside the organisation, then scan for domains that should not be there. It only works on the user's own Drive; there is no admin version across other people's. Send the instruction to the people who worked with the old agency and ask for their lists.

Manage shared drives. Menu → Apps → Google Workspace → Drive and Docs → Manage shared drives lists every drive with its members. Open the member list of each drive the project touched and look for any address outside your domain. This catches external members, not the individual files inside a drive shared to an outsider – those are file permissions, and the member list has no column for them. The shared drive audit goes deeper on that distinction.

A triage rule that scales

Whatever you find, put it in one sheet and sort by domain first, then by owner.

Domain first, because legacy access is decided at the domain level. You do not need to judge forty files individually; you need one decision per counterparty: still active, or ended. An ended domain gets every share removed in one pass.

Owner second, because the owner does the removing. Group the rows and send each person their list with a date. Personal Gmail addresses need a different question – whose is it – and go to the line manager rather than the file owner.

Record three numbers when you are done: rows found, rows removed, rows kept with a written reason. That line is what an auditor asks for.

Where the native tools stop

On Business Starter, Standard and Plus there is no report of every external share across the organisation and no way to search another user's Drive. The log shows six months of changes, the per-user search shows one person, and the shared drive page shows members but not files. Legacy access is, by definition, older than six months and spread across many owners – precisely the shape none of the three can see.

The org-wide scan

Drive Guard for Admins is installed once by a Workspace admin from the Google Workspace Marketplace and deploys to every user, with nothing for anyone else to install. It scans every user's My Drive and every Shared Drive across the organisation, and its dashboard shows public links, external shares and legacy access, with exports. Because the export covers every owner and every drive in one sheet, the domain-first sort above takes a minute instead of a round of emails, and nothing depends on who remembered to reply.

It reports; you decide and you remove. Revoking access from inside the tool is on the roadmap, not live today. Run it before the audit, hand each owner their rows, run it again after, and keep both exports as the before and after.

Sources

• Drive log events – path; default 7 days; Visibility change attribute; Target attribute defined as "user whose access is changed"; export to Sheets/CSV capped at 100,000 rows.
• Data retention and lag times – Drive log events retained 6 months.
• Manage external sharing for your organization – Sharing options path; Off / Allowlisted domains / On; "External users also lose access to any items previously shared with them" (Off case only); up to 24 hours to apply.
• Manage shared drives as an admin – path; admin sees all drives and members.
• File exposure report – edition list; frequently shared-to outside domains.
• Delete or remove a user from your organization – https://knowledge.workspace.google.com/admin/users/delete-or-remove-a-user-from-your-organization (read 2026-09-01 for DGA-B4) – suspension is reversible; untransferred files of a deleted user kept 20 days.
• Google Drive search operators – sharedwith:external documented as "Find items explicitly shared with users or groups outside your Google Workspace organization". Re-read 2026-09-09.