GuideGeeplo guides

Who has access to my Google Drive — and how do you check, file by file?

Asking who can open what in your Drive is a visibility question, and it has a plain answer. This page walks the four places the answer lives: the sharing list on each file, what a Google Workspace admin can and cannot see, the org-wide view of external sharing and the policy that gates it, and the third-party grants — apps and AI assistants among them — that hold Drive access of their own. Google’s own tools first, honestly; then the point where checking by hand stops keeping up.

Written by the Geeplo team. Reviewed by Miguel Perez, co-founder. Last updated November 1, 2026.

Can a Google Workspace admin see your Drive files?

The honest answer separates two things people lump together: governing Drive, and reading it.

• What admins see is the governance layer. Sharing policy, account state, ownership, and a log of sharing events across the organization — which files moved to which sharing scope, and when. That is metadata about files, not the files themselves.
• What admins do not get is automatic read access. A file you own is still yours: an admin does not browse your My Drive the way you can, and the contents need the file shared with them or the ownership moved through a documented admin route. Check Google’s current documentation for what your edition allows, because capabilities follow the edition.
• What that means, both ways. If you are the user: visible does not mean openable — an admin can see that a file was shared and control whether it may be, without reading it. If you are the admin: your honest tools are policy, log events, and ownership transfers, and treating those as the whole picture is correct, not a gap to work around.

How do you see who has access to a specific file?

For one file, the file itself holds the answer, and the answer has two parts:

• Open the file’s Share dialog as its owner. The People list names everyone added directly, each with a role — viewer, commenter, or editor. That is the named half of the answer.
• Check the general access setting under the list. The other half: whether the file is closed to the named people only, or open to anyone who has the link. When it is open to the link, the named list stops being the whole answer — anyone the link reaches can open the file.
• Expand groups into people. A group on the list is one line that stands for every member of it, so the group’s membership is part of the answer.
• Read Shared Drives as two layers. Membership in the drive applies to everything in it — manager, content manager, contributor, commenter, viewer — and individual files can carry their own shares on top. Who can open a file in a Shared Drive is the drive membership plus the file’s own list.

How do you see external sharing across the organization?

File by file answers one file at a time. For the org-wide picture, Workspace admins have two native surfaces:

• Drive log events, in the Admin console’s reporting. Sharing activity is recorded as events across your users — which files moved to which sharing scope, and when. Read it as metadata: it shows where sharing went, not what the files contain.
• The security investigation tool, on editions that include it. It searches Drive across the organization by file attributes — sharing scope among them — so you can pull up what is shared outside your domains and look at each result. Check Google’s current Admin console for the tool’s location and your edition’s coverage, because both follow the edition.
• What neither hands you is a standing answer. Log events are events; a search describes the day you ran it. Drives keep moving — new files, new shares, new members — so the org-wide picture is a picture you take, not one that holds still.

How do you disable or block external sharing?

The native route is policy, and it is genuinely strong — with one boundary to know before you rely on it:

• Set Drive sharing settings in the Admin console. You can block sharing outside your domains entirely, allow it only with domains you name as trusted, or leave it open — org-wide, and per organizational unit where your edition supports it.
• Trusted domains keep partner work working. The allowlist form of the policy is the one most organizations want: internal sharing unaffected, outside sharing possible only where you have decided it should be.
• Policy gates the future, not the past. Tightening the setting stops the next external share; it does not unshare what has already gone out. Existing external shares need a review of their own before the policy picture is complete.

What about apps and AI assistants connected to Drive?

The same question, one layer up — and the layer most reviews miss, not because something went wrong, but because the grants are quiet:

• Every connect click is a grant. A third-party app that asks for Drive — an editor, a scheduler, and increasingly an AI assistant — holds the access a user granted until someone revokes it. An assistant that reads Drive can open everything its grant covers; that is the point of the grant.
• Both sides have a list. Users see their own grants in their Google Account’s security settings, listed as third-party apps with account access, and can remove one there. Admins govern which third-party apps can reach Workspace data through the Admin console’s API controls. The exact locations move with Google’s console — check the current paths in your edition.
• Add the layer to the review. A complete answer to “who has access to my Drive?” is files, policy, and grants — the app list is the third part, and it answers the same visibility question the rest of this page asks.

Geeplo holds Drive access the same way — as a grant. Every scope its service account is granted is published on the Scopes page, with the module that uses it and why.

How do you keep the answer current?

The honest limitation of everything above: each check describes the day you ran it. Drives change daily, so the standing version of the answer is an inventory, not a checklist. That inventory is what ShareGuard keeps:

• Every drive, every file, who can open it. ShareGuard inventories each person’s My Drive and every Shared Drive, then records who can open each file and how.
• Trusted is a setting, not a flag to chase. Your own domains and the partners you add count as trusted and are never flagged; for everything else, drill down by outside domain to see what that company can open and who owns each file.
• Cleanups run on a schedule, owners act first. Each run picks the files with the most outside shares and gives their owners a deadline in My ShareGuard; what is still open after the deadline waits for your approval, and shares with trusted domains are never touched.

Where this fits

The Google Workspace offboarding guide places the share review as one step in the leaver sequence; the ShareGuard page details the inventory, the domain drill-down and the cleanup flow behind that step; and the Scopes page publishes every scope Geeplo’s service account is granted, per module, with the reason.