Stale access builds up quietly. A contractor's project ends, a bookkeeper changes roles, or a link sent for one meeting keeps working. Pick a shared folder your team actually uses, ideally one holding client, payroll, or personnel files, and ask its owner to open the sharing settings with you and list the people and groups with access.

Three ways people reach a folder

Direct access is a named person with a role such as Viewer or Editor. Group access gives one role to everyone in a group, and that group's membership is usually managed somewhere else. Link access depends on the link's audience, which can be specific people, everyone in your organization, or anyone who has the link. Check direct permissions separately from links, because someone may be able to open a file through a shared link or group even if their name does not appear in the direct list.

Inheritance runs through all three. In Google Drive, files and subfolders inherit the folder's sharing, and Google says you cannot give someone less access to a specific file than they have on its parent folder. In SharePoint, Microsoft says permission to a site, group, or team gives access to all of the site's content, and people may reach a folder through access to the site itself.

Two quieter routes are easy to miss. Files inside a folder can also be shared on their own, so a sensitive file may have more people on it than the folder does. In Google Drive, a folder shared with a Google Chat space opens automatically to anyone who joins that space later.

Pull the list in Google Drive

Right-click the folder and choose Share, then Share again. The dialog shows the People with access list, including any Google Groups, with each entry's role, plus the General access setting: Restricted, your organization (work or school accounts only), or Anyone with the link. Google says Anyone with the link lets anyone on the internet who has the link open the item without signing in to a Google Account, and its help center advises checking both the People with access list and General access to get the complete picture.

On Google Workspace accounts, Drive may show an External badge on files that people outside your organization can reach, including files shared with an external Google Group or published to the web. It is a quick way to spot what needs a closer look, though administrators can turn the badge off.

In a shared drive, review the members too. Google says all members can view every file and folder in the drive unless a folder has limited access, and members with the Manager, Content manager, or Contributor role can share files with other people and groups unless the drive's sharing settings prevent it.

Pull the list in Microsoft 365

In OneDrive or a SharePoint library, select only the folder, then select Details in the upper-right corner to open the Details pane. Under Has access, select Manage access to see the sharing links and the people with direct access. To review access that comes from the site itself, select Settings and then Site permissions.

On a site connected to a Microsoft 365 group, group owners become site owners and group members become site members, and Microsoft recommends managing a team's site permissions in Teams. Microsoft 365 groups have no view-only access, so people who only need to read are added directly to the site's Visitors group, and the team's member list alone will not show them.

Microsoft describes three main link types. Anyone links need no sign-in and their access can't be audited, People in your organization links work for anyone in the organization they are forwarded to, and Specific people links work only for the people named when the item was shared. To see what you have shared in OneDrive and SharePoint, open OneDrive on the web, select Shared in the left pane, and then select the By me tab.

Decide what stays

The test for every entry is least privilege: the minimum access each person needs for the work they do now. Work through people who changed roles, collaborators whose project has finished, and links open to a larger audience than intended. Write down every entry and its role before changing anything, so a mistake can be reversed.

Check roles as well as names. In Google Drive, an Editor on a folder can edit, delete, or move any file in it and, by default, change permissions and share, while a Viewer can open the files but cannot change, comment on, or share them. Someone who only needs to read does not need to be an Editor.

Ask the owner what each group is for before removing it. For an unclear entry, record who can explain it and follow up. Avoid removing the only person who can manage the folder.

If the owner of a Google Drive folder is the one changing roles, they can choose Transfer ownership from the arrow next to a colleague's name in the Share menu. Google notes that the new owner must already have access, that work or school accounts can transfer only within the organization, and that the original owner still owns the files inside a transferred folder. A Google Workspace administrator can also transfer someone's Drive files in bulk.

Make the changes

In Google Drive, open the Share menu, click the arrow next to a name, choose Remove access, and select Save. To narrow a broad link, set General access to Restricted and add the people who need the folder by name. On work and school accounts, Add expiration in the same menu ends a person's access on a date within one year, though for folders it is available only for the Viewer role.

If a subfolder needs a smaller audience, open its share dialog, select Settings, turn on Limit access, and then add the people who should have it. In My Drive the folder's owner can do this, as can editors who are allowed to change permissions, and in a shared drive a Manager can. People with access to the parent folder may still see the limited folder grayed out, so keep sensitive details out of folder names.

Shared drives need one more step. Removing a member also ends their access to files and folders in that drive that were shared with them directly, but every remaining member can still at least view the content unless a folder has limited access. To keep members out of a folder, a Manager can limit access to it or move it out of the shared drive.

In Microsoft 365, open Manage access. Select a person's name under Direct Access to change or remove their permission and select Apply, or open the Links tab and select Remove Link next to a link. If the access is inherited, Microsoft says to remove it at the parent folder or site instead.

A sharing link's permission cannot be switched between edit and view, so delete the link, create a new one, preferably for Specific people, and send it to those who still need it. Change group or team membership in Teams or in the group itself.

Mistakes to watch for

These leave access in place or break work someone relies on:

  • Removing a person while an old link still opens the folder.
  • Missing access that still comes through a group, a shared drive, a Chat space, or the site.
  • Checking only the folder when a sensitive file inside it was shared separately.
  • Trying to restrict one file inside a widely shared Google Drive folder instead of moving it to a limited-access folder.
  • Deleting a link that a client upload request or another routine depends on without telling the person who uses it.
  • Leaving editors able to reshare when the owner could uncheck Allow editors to change permissions and share.

Verify the result

Use an account that should have access, or ask a colleague who has it, to open the folder and confirm the work still gets done. Then try the folder link with an account outside the intended audience, which should be asked to request access. Finally, open the link in a private browser window without signing in. If the folder opens, a link open to anyone is still live.

Expect access requests afterward. In SharePoint, a site owner turns on Allow access requests under Settings, Site permissions, Change how members can share. By default, requests then go to the site's Owners group, or to the group administrators on a site connected to a Microsoft 365 group or team. Pending requests appear under Settings, Site contents, Access requests, and that button shows only while a request is waiting.

In a Google shared drive, a request for a file or folder goes to the person who created it, or to the drive's Managers if that person cannot share it. In Google Drive, a dot next to the Share button means a share request is pending. Approve a real need at the right level instead of restoring the old broad link.

Keep the next review small

Record the folder, owner, changes, entries still waiting on an explanation, and the next review date. Repeat the exercise one folder at a time so someone understands each change and can respond if a legitimate workflow is affected.

Settings can also keep access from going stale. If your organization allows Anyone links at all, administrators can require them to expire within a set number of days and limit them to view only, under Policies and then Sharing in the SharePoint admin center. The same page can make guest access to a site or OneDrive expire automatically. In Google Drive, Add expiration does something similar for one person at a time on work and school accounts.

A worked example

Imagine a ten-person accounting office whose managing partner owns a Client Returns folder in her Google Drive. She and the office manager find four items to question: a bookkeeping contractor whose project ended months ago, a preparer who moved to payroll but is still an Editor, a group called tax-season that neither recognizes, and General access still set to Anyone with the link from when a client needed a large file.

They write the list down first. Then they remove the contractor and the preparer, set General access to Restricted, and share that one client's file directly with the client as a Viewer. The office's IT contact will explain the tax-season group by Friday, so it stays until then and is marked as pending.

Next they test. A staff accountant can still edit returns, the receptionist's account is asked to request access, and the link in a signed-out private window asks for a sign-in. The partner records the changes and puts the next review on the calendar for next quarter.

What to do this week

  • Choose one folder and book time with its owner.
  • List every person, group, and link before changing anything.
  • Remove what no longer matches current work, then test from inside and outside the audience.
  • Record the changes and put the next review on the calendar.

Where ALCO can help

ALCO USA Inc is an IT services company headquartered in Caldwell, Idaho. Its listed services include Google Workspace, covering Drive and the admin console, and Microsoft 365, covering Teams and SharePoint, along with cybersecurity and compliance and user training. If a review turns up access nobody can explain, the ALCO help desk is staffed 24 hours a day, including holidays, and calls are answered by a person.

Sources