Shared workspaces collect exceptions, such as a contractor added for one project, a link sent to a client or a group added because it was quicker. Each exception made sense on the day, and few of them get removed when the reason ends. A review simply goes back through the exceptions and asks whether each one still has a reason.

The steps below use a Google shared drive and a Microsoft Teams team as examples, because most small organizations use one or both. Pick one workspace, finish the whole cycle on it, and only then move to the next. A single complete review teaches you more than a rushed pass over everything.

Know how people get access

Access to a workspace rarely comes from one list. In a Google shared drive, members are people or groups with one of five access levels: Manager, Content manager, Contributor, Commenter and Viewer. Google says only Managers and Google Workspace admins can add members and set their access levels. Content managers can create, edit and share files and folders, but cannot manage members, and a Manager or admin can stop them from sharing folders. Contributors can add files but cannot share folders, and Commenters and Viewers can only comment or view.

Every member can view every file and folder unless a Manager has restricted a folder to certain members. Individual files and folders can also be shared with people who are not members. When you share by link, the General access setting is Restricted, your organization, or Anyone with the link. Google says Restricted means only people who have been given access can open the file, and that Anyone with the link lets anyone open it without signing in.

In Teams, the team's membership is stored in a Microsoft 365 group, and that group also gives people access to the team's parent SharePoint site, where all standard channels keep their files. Team owners and members are automatically included in the site's owners and members permission groups. Each private channel and each shared channel gets its own SharePoint site that only the channel's owners and members can open.

Files and folders on these sites can also carry sharing links. Microsoft's sharing report names the link types Anonymous (the Anyone link), Organization and Specific People. The first needs no sign-in at all, which makes it the one to look for first.

Choose the workspace and who decides

Start with the workspace that holds client, financial or personnel files, or the one shared most often with vendors. A workspace with guests, or one that has seen staff or vendor changes since anyone last looked, comes next.

Two people need to be involved. The owner, meaning a Manager of the shared drive or an owner of the team, decides what each entry should become. The other is whoever holds the admin rights some steps need, since Microsoft says the SharePoint sharing report must be run by a site admin and Google's shared drive tools in the Admin console need the Drive & Docs administrator privilege. Agree before you start that nothing changes until the owner confirms it.

Write down who has access

Export the access list or note the names and roles first, so mistakes can be reversed. In a Google shared drive, a Manager can open Manage members to see each person or group and its access level. For each entry, note the role, whether it is a person or a group, and whether the address belongs to your organization.

Groups hide people. Google's Admin console shows a group's direct members and its indirect members, meaning people who belong through a nested group, in one list, and Google says a group with 5,000 members or fewer can be exported to a CSV file. Check the exported file against a small test group before you rely on it for nested members.

In Microsoft Teams, a team owner selects More team options, Manage team, then the Members tab to see members and guests. On the team's SharePoint site, a site admin can choose Settings, Site usage, then Run report under Shared with external users. Microsoft says the result is a CSV file of every unique file, user, permission and link on the site, saved where you choose, with an email when it is ready. If site members should not see it, Microsoft suggests saving it in a folder that only site owners can open.

In the report, the User or Group Type column separates Member (internal), Guest (external), SharePoint group, Security group and Microsoft 365 group entries. Microsoft notes that Member means a member of your directory, not of the site, so start with the Guest (external) rows.

Compare the list with your roster

Check each entry against your current staff and vendor roster, and flag:

  • People who left or changed roles.
  • Vendors and guests whose work has ended.
  • Groups, since anyone who joins a group later gets the same access.
  • Owners or Managers who no longer run the work.
  • Roles larger than the work needs, such as editors of finished files.
  • Personal email addresses on business files.

Then decide what each flagged entry should become. Remove access when the person or the contract is gone. Lower the role when someone still needs to read but not change. Replace a broad link with named people when you can list who needs it, and set an end date when the need is real but temporary.

Google makes new shared drive members Content managers by default, so a list full of Content managers may reflect that default rather than a decision. Keep a group only if everyone in it, now and later, should have its access.

Look past the member list

Direct shares and links do not appear on a member list, so check them separately. In Google Drive, open the sharing details of the folders people share most and read the General access setting. Google also says Drive can show an External badge on files shared with people outside your organization, though an admin can turn that badge off. Ask a Manager about folders with limited access, which other members cannot open but people added to them directly can.

In Teams, check private and shared channels as well. Microsoft says team owners can see the names of all shared channels in their team but cannot see a shared channel's files, conversations or member list unless they belong to it. Ask each shared channel's owner to review the Members tab under Manage channel.

The sharing report has gaps. Microsoft says it lists SharePoint groups but not the people inside them, and it leaves out Anyone links and links that were emailed but never clicked. A site owner should open each listed group separately, and should look at the sharing links on the folders that matter most.

Change only what the owner confirms

Ask the owner to confirm anything unexpected, and leave unexplained entries in place until someone explains them. If an entry looks risky, such as an Anyone link on a folder of client records, raise it with the owner that day. Change only confirmed stale access, starting with the riskiest items.

To remove a person from a single Google file or folder, Google's steps are the Share menu, the arrow next to their name, Remove access, then Save. A folder cannot give a shared drive member less access than they have to the drive itself, so to lower someone's role across the whole drive, change their level in Manage members.

In Teams, remove a member or guest on the Members tab with the X beside their name. Microsoft says to change an owner to a member first, then remove them. Team owners can only remove people from a team. Only an admin can remove someone from the organization, so tell your admin about departed staff as well.

Microsoft also warns that if someone was granted access directly to a file, folder or notebook in a shared channel through SharePoint, removing them from the team or the channel does not remove that access. After any departure, look at the shared channel's folders as well as its member list.

Keep an owner on every workspace

Never leave a workspace without a current owner. Microsoft says that if the last owner of a shared channel leaves the organization, a channel member from your organization is promoted automatically, and if there is no one to promote, the channel stays ownerless until a Teams admin assigns an owner. Microsoft suggests adding more than one owner to avoid this. With two owners who both run the work, one departure cannot strand it.

For Google, a Workspace admin can find shared drives with no managers. In the Admin console, go to Menu, Apps, Google Workspace, Drive and Docs, then Manage shared drives, select Add a filter and choose No managers. Google says an admin can then add a Manager through Manage members even if the admin is not a Manager of that drive.

Test access and set the next review

Use a test account set up like an approved user to confirm approved users still have what they need, and that an outside account cannot get in. For a link you removed or changed to Restricted, open it in a private browser window that is not signed in and confirm the item no longer opens.

Then rerun the checks that found the problems. Run the sharing report again and confirm removed guests have no rows. If a test fails right after a settings change, wait and retest the next day before concluding that the change did not work.

Finally, record the owner, the changes, the open questions and the next review date, such as next quarter's end. Without that record the next reviewer starts from nothing, and the review quietly stops happening.

Common mistakes and how to spot them

  • Reviewing only the member list. Links, direct shares and channel files sit outside it, so a clean member list proves little.
  • Removing a whole group to remove one person. Everyone else in the group loses that access too, so change the group's membership instead.
  • Treating a guest removed from a team as gone from the organization. The guest account can still exist in your directory, and Microsoft's guidance on stopping sharing says to remove permissions from the item or remove the person as a guest in your directory.
  • Removing people from a shared channel and assuming their files are closed. Direct access granted through SharePoint stays until someone removes it.
  • Fixing everything at once. Changes made without the owner's confirmation break real work and teach people to hide their sharing.

A worked example

Imagine a twelve-person engineering firm whose Projects team in Teams has two owners, the principal who runs the work and an estimator who moved to accounting. The office manager, a site admin for the team's site, runs the sharing report into a folder only owners can open. With the principal, she reviews the Members tab and the sharing links on the three folders the team shares most, and she asks the owner of the team's one shared channel, used with a structural consultant, for its member list.

She flags a guest whose drafting contract ended in August, the estimator's ownership, a client folder shared with a personal email address, and an Anyone link on a folder of signed drawings that the report did not show. The principal confirms all four. He removes the guest on the Members tab, changes the estimator's role to member and removes the personal address from the folder. The drawings link was made for a client's lender, so he deletes it and sends the lender's two contacts a Specific people link instead. The firm's Microsoft 365 admin then removes the drafting guest from the directory.

Afterward, a test account set up like a drafter still opens the project folders, the old drawings link no longer opens in a private browser window, and a second sharing report has no rows for the guest. The office manager files both reports with a note of the changes and books the next review for the end of March.

What to do this week

  • Pick one workspace and name the owner who will confirm changes.
  • Write down its members, and run the sharing report if it is a team.
  • Ask your admin to run the No managers filter for shared drives, or to check shared channels for missing owners.
  • Check the sharing links on the three most-shared folders.
  • Remove confirmed stale access, then test with a test account and a private window.
  • Record the changes and put the next quarter-end review on the calendar.

Short answers to common follow-ups

Quarter-end is one workable rhythm, with an extra check whenever someone leaves or a vendor contract ends. Microsoft Entra access reviews can automate part of this, and Microsoft says they can recur weekly, monthly, quarterly or annually. They require a Microsoft Entra ID Governance or Microsoft Entra Suite subscription, and some capabilities may work with Microsoft Entra ID P2, so confirm your licensing before planning around them.

Some businesses are required to review access. The FTC's Safeguards Rule, which the FTC says covers businesses such as mortgage lenders, tax preparation firms and collection agencies, requires them to implement and periodically review access controls. The exception in 16 CFR 314.6 for institutions holding customer information on fewer than 5,000 consumers lists paragraphs (b)(1), (d)(2), (h) and (i) of section 314.4, and the access control paragraph, (c)(1), is not among them.

Temporary access can end on its own. In Google Drive, a work or school account can choose Add expiration next to a person's name in the Share menu and pick a date within one year, though on folders it applies only to the Viewer role.

Staff can check what they shared from their own storage. In OneDrive, Settings, OneDrive settings, More settings, then Run sharing report produces the same kind of CSV for one person's files.

Departed staff need a plan for their files. Microsoft says a deleted user account and its data can be restored within 30 days of deletion, so ask your admin to transfer or save anything the business needs before deleting an account, and do not rely on the restore window as a plan.

Separate workspaces work better than switches. Google suggests creating separate shared drives for internal and external collaborators and adding the prefix [External] or [Internal] to the name. Microsoft recommends keeping information that should never be shared externally in a site that has external sharing turned off.

Where ALCO can help

ALCO USA Inc is an IT services company headquartered in Caldwell, Idaho, with technicians serving businesses across Idaho. Its listed services include Google Workspace, Microsoft 365, cybersecurity and compliance, and user training. If a review turns up access nobody can explain, the ALCO help desk is staffed 24 hours a day, including holidays, and calls are answered by a person.

Sources