# The Drive files anyone can still open: how we find and close every external share

Published: 2026-11-05  
Author: Guanacos Tech (https://guanacostech.com)  
Canonical: https://guanacostech.com/blog/audit-externally-shared-google-drive-files

> See which Drive files are open to anyone with the link, learn which audit route your edition actually gives you, and close the risky shares safely.

**Short answer:** Use the route your edition gives you: the file exposure report on Enterprise Plus and Frontline Plus, Drive log events filtered by visibility change on the Business editions, or a Drive API scan for visibility='anyoneWithLink', which is the only current-state list. Then set the general access default to Restricted so new files start private.

The question arrives in the same week as every Workspace cleanup we run. An owner asks, in plain words, which files a stranger can open right now. The honest first answer is a question back: which edition are you on? Google gives you a different amount of help depending on what you pay for, and the report most articles point at is not the one most small businesses can open.

Say a 30-person distributor that moved off OneDrive last quarter. On the surface nothing looks wrong, and nobody has complained. What no one has looked at is the pile of sharing links made over six years by people who have since left, several of them still set to anyone with the link can edit. No alert fires for that. Drive is doing what it was told to do.

## What "shared externally" actually covers

Drive has more than one way to be open, and they fail differently. Google's reporting splits them: a file can be private, shared internally with named people, open to anyone in your organisation who has the link, open to anyone with the link, or shared with named people outside your organisation. The Admin reporting metrics use the same split: `shared_externally` for people or groups outside the owner's domain, `anyone_with_link` for the open link.

Keep two of those apart in your head. A named external share is a decision somebody made about a person: the accountant, the lawyer, a client contact. An open link is a decision about nobody in particular. It outlives the person who made it and the project it belonged to, and it can be forwarded without leaving a trace. Open links go first.

Drive does mark the risky ones. By default it shows an External indicator on files owned by or shared with people outside your organisation, and an admin can turn that off per organisational unit or group. Turning the badge off does not stop the sharing being recorded in Drive log events, which matters for the audit.

## Which route applies to your edition

This is the part that saves a wasted afternoon. The file exposure report, the screen most write-ups assume you have, is listed for Frontline Plus, Enterprise Plus, Education Standard and Education Plus, and Enterprise Essentials Plus. On Business Starter, Standard or Plus it is not there, and neither is the security investigation tool. The other routes still get you the answer. Editions below were read from Google's own pages on 5 November 2026.

| Route | What it needs | What it gives you |
| --- | --- | --- |
| File exposure report, in the security centre | Frontline Plus, Enterprise Plus, Education Standard or Plus, Enterprise Essentials Plus, plus the security centre admin privilege | Sharing types over time (private, internal, anyone in domain, anyone with link, external), the outside domains shared to most often, and a per-domain spreadsheet export of the files |
| Drive log events, under Audit and investigation | Listed on all three Business editions in Google's own edition comparison; the Audit and investigation admin privilege | Events rather than current state: `Visibility change`, prior visibility and the target audience, searchable for up to six months |
| Security investigation tool | Enterprise Standard and Plus and the other premium editions, not the Business ones | The same log with action on the results and a far larger export; the comparison pages cap log exports at 100,000 rows without it |
| A Drive API or Apps Script inventory | Any edition; a super admin authorises domain-wide delegation for a service account | Current state, user by user: every file matching `visibility='anyoneWithLink'` or `visibility='anyoneCanFind'` |
| Security health page | Frontline Plus, Enterprise Plus, Education Standard or Plus, Enterprise Essentials Plus | Settings recommendations rather than files: confine sharing to the domain, warn before out-of-domain sharing, Access Checker set to recipients only |

On the Business editions you can see **what happened** in the log, and work out **what is true now** with a scan. No screen in the Admin console hands you the second one.

## What we check before touching a single file

Revoking today's links while the settings keep minting new ones is wasted work, so the settings pass comes first.

1. **The general access default.** Google documents Restricted as the default and as the right setting for most users. What matters is what it is set to in your tenant, because it can be scoped by organisational unit and by group, and group settings override organisational units.
2. **Sharing outside the organisation.** On, off, or limited to allowlisted domains. The middle setting fits most small businesses better than a blanket On, and it is the one we end up recommending.
3. **The out-of-domain warning.** It appears when external sharing is set to On or to Allowlisted domains, and asks the user to confirm before the file leaves. Cheap, and it catches the accidental share.
4. **Access Checker.** When someone attaches a Drive link in Gmail, this is what decides whether they are nudged to widen access. The Drive security health page recommends recipients only at the root organisational unit.
5. **Target audiences.** The predefined audience is your whole organisation, and whichever audience sits in the primary position becomes the first link-sharing option users see. A policy can carry up to five. Users on an edition that does not support them see only the primary one.

One trap, before you hunt for a setting that is gone: on the editions that support trust rules, turning them on replaces the Drive sharing settings, so the setting for sharing outside your organisation is deactivated and its recommendations leave the security health page.

## The scan that answers the question

Current state needs an API call, because Drive permissions live per file and per user. Drive search syntax has a visibility filter: `anyoneWithLink` returns the files reachable by link, and `anyoneCanFind` the ones that can also surface in search results. We run it per user into a sheet with the owner, the file and the link.

```
GET https://www.googleapis.com/drive/v3/files
  ?q=visibility='anyoneWithLink'
  &fields=files(id,name,owners,webViewLink)
  &pageSize=100
```

Two practical notes from real tenants. The service account has to be authorised by its numeric client ID, not its email address, which is the usual cause of an `unauthorized_client` error; Google says the change can take up to 24 hours, though it is normally quicker. And because Google's own guidance is to avoid domain-wide delegation when a narrower route will do, we scope the credential to Drive, run the inventory, then remove the authorisation. Shared drives need a separate pass.

## Why a migration leaves the door open

If the files arrived from somewhere else, the sharing arrived with them. Google's file migration maps OneDrive permissions and sharing links into My Drive, keeping one link per item and the most restrictive of them, and it leaves behind expiration dates and items owned by external users. We went through what the import keeps and drops in [OneDrive and SharePoint to Google Drive](https://guanacostech.com/blog/onedrive-sharepoint-to-google-drive).

The detail that matters for an audit: the link survives and the expiry does not. A link set to die in 30 days arrives with no end date at all. The sharing state that lands on the Google side is not the one you left behind, so the audit belongs in the cutover plan rather than in a cleanup six months later.

A cutover leaves two doors open, files and mail, and the mail half takes a minute to check:

Free tool

Check your domain's SPF, DKIM and DMARC

Paste a domain and get the live authentication results in about 30 seconds. No signup.

[Run the free check](https://guanacostech.com/email-troubleshooter)

## Closing the links without breaking work

Sort the list by owner, then by age. Anything from the last quarter goes back to its owner with one question: is this still needed, and does it need to be open to the internet or to a named person? Anything older than a year whose owner has left gets revoked without asking. What is still needed becomes a named share, with an expiration date where the access is temporary.

Mechanically the revoke is a list and a delete: find the permission whose type is `anyone`, then remove it by its ID.

```
GET    /drive/v3/files/{fileId}/permissions
DELETE /drive/v3/files/{fileId}/permissions/{permissionId}
```

Two behaviours to respect. An inherited permission cannot be revoked on the child item, so the change belongs on the parent folder. And concurrent permission changes on the same item are not supported, only the last one lands, so the script runs serially per file. For the handful of files that need a conversation anyway, the owner doing it by hand from the share dialog is often better.

Expiration dates are the part teams forget they have. On a file you can set one for viewers, commenters and editors; on a folder it applies to the viewer role, and an editor or commenter drops to viewer when it lapses. When temporary access ends the person falls back to whatever the parent folder gives them, so check the parent before you rely on it.

## What we watch for the two weeks after

A clean inventory decays. The two weeks show whether the settings pass changed behaviour, and the signals are in the log you already have.

We set a reporting rule on Drive log events for visibility changes to external, and read the first week of hits one by one rather than counting them. Three timing facts keep the review honest: Drive data can take up to 80 minutes to reach the exposure report on some domains, Admin console changes up to 24 hours to show on the security health page, and log events are searchable for about six months, so an audit of older behaviour has a floor.

The other half is human. One short message saying the default is now Restricted, and here is how to share with a client properly, prevents the workaround that undoes the whole pass: files copied to a personal account because the official route felt broken. If people route around the policy, the policy is wrong, and the log shows that too.

## How Guanacos Tech helps

We run this as one piece of work: the settings pass with the defaults set per organisational unit, the per-user inventory of open links, the revoke list with owners consulted where a file is still live, and the monitoring that keeps the pile from rebuilding. If your edition has no exposure report, the inventory is the part we bring, and the sheet is yours at the end.

If you want that done rather than described, we are [Google Workspace consultants](https://guanacostech.com/google-workspace) who do this for small and mid-sized teams in North America and Latin America. A 30-minute call is enough to tell you which route your edition gives you and how long the inventory will take on your domain.

## Sources

- [Google Workspace Admin Help: Manage external sharing for your organization](https://support.google.com/a/answer/60781)
- [Google Workspace Admin Help: Set general access sharing options for your organization](https://support.google.com/a/answer/12732365)
- [Google Workspace Admin Help: File exposure report](https://support.google.com/a/answer/7491249)
- [Google Workspace Admin Help: Drive log events](https://support.google.com/a/answer/4579696)
- [Google Workspace Help: Compare Business editions](https://knowledge.workspace.google.com/admin/getting-started/editions/compare-business-editions)
- [Google Workspace Admin Help: Monitor the health of your Drive settings](https://support.google.com/a/answer/7492096)
- [Google Workspace Admin Help: About target audiences](https://support.google.com/a/answer/9934697)
- [Google Drive Help: Stop, limit, or change sharing](https://support.google.com/drive/answer/2494893)
- [Google Workspace Admin Help: What is migrated in a file migration](https://knowledge.workspace.google.com/admin/migrate/whats-migrated-in-a-file-migration)
- [Google Drive API: Search for files and folders](https://developers.google.com/workspace/drive/api/guides/search-files)
- [Google Drive API: Method permissions.delete](https://developers.google.com/workspace/drive/api/reference/rest/v3/permissions/delete)
- [Google Workspace Admin Help: Control API access with domain-wide delegation](https://support.google.com/a/answer/162106)

## Frequently asked questions

### Can I see every externally shared file from the Admin console?

Only on some editions. The file exposure report is listed for Frontline Plus, Enterprise Plus, Education Standard and Plus, and Enterprise Essentials Plus. On the Business editions you get Drive log events, which record visibility changes as they happen, so the current list of open files has to come from a Drive API inventory instead.

### Do sharing links survive a move from OneDrive to Google Drive?

Yes. The Google file migration maps OneDrive permissions and sharing links into My Drive, keeping one link per item and the most restrictive of them. Expiration dates, previous versions and items owned by external users do not come across, so a link that was due to expire arrives with no end date.

### Can I make a Drive link expire?

You can set an expiration on a file for viewers, commenters and editors. On a folder it applies to the viewer role, and an editor or commenter drops to viewer once the date passes. When temporary access ends, the person keeps whatever access the parent folder already gives them, so check the parent first.

---

Guanacos Tech is an independent consultancy with Google-certified engineers: email deliverability, Google Workspace and Google Cloud, in English and Spanish. Book a free 30-minute call: https://calendar.app.google/pq2seCCcch9U2GFV8