Control access to files and folders in shared drives

Supported editions for this feature: Business Standard and Business Plus; Enterprise; Education Fundamentals, Instruction Standard, Teaching and Learning Upgrade, and Education Plus; Nonprofits; Grand Suite Business; Essentials. Compare your edition

As an ambassador, you can apply restrictions to your entire organisation. Or, gear up different rules for groups or departments.

You tin can also prevent shared bulldoze members with Manager admission from modifying settings. In the shared bulldoze, yous tin can restrict:

  • Non-members from accessing files
  • People outside your arrangement from accessing files
  • Commenters and viewers from downloading, copying, and printing files

Control file sharing and access

Expand all  |  Collapse all

Moving and sharing files

If you want to allow users without a Google Business relationship to collaborate on files as visitors, become to the steps for sharing with not-Google Accounts instead.

When a file is moved into a shared drive, it keeps its file-sharing permissions. So if an owner sets their file to foreclose downloading, copying, and printing, it stays like that after it's moved to a shared drive. Moving files does not affect sharing permissions or user roles, such as Content manager or Viewer.

Users can't share files with anyone outside the shared drive's restrictions. For example, if a shared bulldoze restricts users outside the arrangement from accessing the shared drive's content, external users are removed from files in that shared drive in the future.

If you change a shared bulldoze's restriction settings, this does not automatically remove existing users or change a file'south sharing permissions. For case, assume a user outside the organization is added to a file. Then after on, a restriction is applied to the file's shared drive. In that case, the external user is non removed from the file. This means a user might regain access if restrictions are relaxed in the time to come.

Set the default access for all new shared drives

Admins can define the post-obit options to restrict access to all new shared drives. Visit the Google Workspace Updates blog for more than data.

Employ the default sharing restrictions to restrict access to the content in all new shared drives. These settings must be actively enabled.

Define the default sharing restrictions

  2. From the Admin console Home folio, get to Apps and then Google Workspace and then Drive and Docs.

  3. Select Sharing settings.
  5. Next to Shared drive creation, select the default restrictions for all new shared drives.
    • Prevent users in your organisation from creating new shared drives
    • Permit members with managing director access to override the settings below
    • Permit users outside your organization  to access files in the shared bulldoze
    • Allow people who aren't shared bulldoze members to be added to files
    • Allow viewers and commenters to download, print, and re-create files in the shared drive

Note: If Allow members with manager access to override the settings beneath is checked, managers can override whatsoever of these default restrictions for individual shared drives.

Key things to remember

  • If a document is moved in to a shared drive with default sharing restrictions:
    • These default settings override any document-level sharing settings, which might consequence in some users losing access to documents. If members will lose access, a warning is displayed before the file is moved.
    • The certificate'southward protections all the same employ if the shared drive has less restrictive protections.
  • If a document is moved out of the shared drive to My Drive within the same organization:
    • The document'southward original sharing settings are used instead. This can effect in users gaining or losing access.
    • Document-level restrictions always stay in identify unless specifically inverse or removed from the document. Shared drive restrictions but apply to documents when they are in the shared bulldoze.
  • Changes to these default restrictions exercise not bear on existing shared drives:
    • If these default restrictions are inverse, users are not removed from the shared drive or individual file permissions.
    • If the shared drive restrictions are more restrictive than the file permissions, all the same, some users might lose admission to the file.
    • If the shared drive default restrictions are removed, some users might regain access.

Restrict access for an existing shared bulldoze

  2. From the Admin console Home page, go to Apps and then Google Workspace and then Bulldoze and Docs.

  3. Select Manage shared drives.
  4. Hover over a shared drive, and click the Settings push.
  5. UncheckAllow managers to modify shared drive settings to keep people from overriding the default settings for the shared drive.
  6. Cheque or uncheck boxes to modify whatsoever of the following options:
    • Sharing outside your organisation —Permit or prevent external people from accessing files in the shared drive.
    • Sharing with not-members—Let or forbid shared drive members from giving non-members access to files in the shared drive.
    • Download, copy, and print—Allow or prevent commenters and viewers from downloading, copying, and printing files in the shared drive.

Control folder sharing and access

Expand all  |  Collapse all

You can share a specific folder with other users. You can likewise upgrade member access to provide users with additional permissions on specific folders within shared drives.

How to use binder sharing

There are a number of scenarios when sharing but a folder (and non an entire shared bulldoze) is important, including:

  • For a marketing department, you can have a shared drive accessible by all internal employees, with a specific folder for advertising materials that's likewise accessible to an external agency.
  • For a shared drive used to prepare for a specific result, you can give all members view access to all files, while providing each specific team with edit access to the documents relevant to their office of the event.

How does folder sharing work?

If yous assign access to a shared drive, the admission level is the minimum level of admission that users will have to all files and folders in the shared drive. Whatsoever folders in the shared bulldoze can only be shared with the same or higher access level. Y'all (and your users) tin can't brand the access to folders more than restrictive.

For instance, a user with Commenter access to a shared drive cannot take Viewer admission to a folder in that shared bulldoze. If access to a file or folder is downgraded, access to parent folders is downgraded equally well.

Change permission on parent folder

Managers of a shared bulldoze can share folders in the shared bulldoze. Folders in shared drives take the same access levels as the shared drives, with the exception of the Manager access level. Learn more than well-nigh Shared drives admission levels.

What happens when someone moves a file or folder?

When someone moves a file or folder in, within, or betwixt shared drives or to My Drive, inherited admission to content is updated, and direct access stays the same.

For example, say you have a certificate in the Sales team shared bulldoze. All members of the Sales team take Viewer access to the shared drive, and therefore, to the document as well. V Sales squad members take Editor access to the document. If the certificate gets moved out of the Sales team shared drive, the Sales team loses their inherited Viewer access, but the 5 users even so have Editor access.

Moving folders in a shared drive tin create broad changes to content access. Therefore, simply users who have Manager access to the original and target locations tin can motility folders into or between shared drives.

Annotation: If you share a folder in a shared drive with the pick Anyone in this group with this link can view, you can't share whatsoever file or folder inside with the option Anyone with the link. To work around this limitation, exercise either of the following things:

  • First, share the item with the option Anyone with the link, then share the parent folder with the choice Anyone in this grouping with this link can view.
  • Employ the API to share the child binder after the parent (API supports this process, but the UI does not).

Where do I find shared folders?

You can notice folders from shared drives in the Shared with me section in Google Drive. If a user has Fellow member access to the shared bulldoze, they will also meet the shared folder under the shared bulldoze in Drive. When yous share a folder, the recipient gets a notification. Anyone can organize shared folders using shortcuts.

Folders do not automatically announced in Google Bulldoze for desktop or a shared bulldoze unless you have Manager admission. Y'all can, instead, create a shortcut to the shared folder to access in Drive for desktop and sync the content.

Control sharing for your organization

Use the following settings to restrict sharing for your system. These settings apply to all Drive files. For instance, if your arrangement restricts sharing outside of the organisation, shared bulldoze content is also restricted.

Expand all  |  Collapse all

Restrict users from moving content exterior of your organisation

Supported editions for this feature: Business concern Standard and Business Plus; Enterprise; Instruction Fundamentals, Education Standard, Teaching and Learning Upgrade, and Didactics Plus; G Suite Business; Essentials. Compare your edition

You can control who can move files and folders exterior of your organization when moving content from:

  • A shared bulldoze in your organization to:
    • A shared drive owned by another organization
    • Someone's My Drive in another organization
  • Someone's My Drive in your organisation to a shared bulldoze owned by another organization

  2. From the Admin console Habitation page, go to Apps and then Google Workspace and then Drive and Docs.

  3. Click Sharing settings and then Sharing options.
  4. Select the desired organizational unit or group.
  5. In Distributing content exterior of yourorganization , select an option:
    • Anyone
      • People with Managing director access to a shared drive tin motility files from that shared bulldoze to a Bulldoze location in a different organization. Acquire more
      • People in the selected organizational unit or group can move content from their My Drive to a shared bulldoze endemic by a different organization (for example, some other business, group, or school). Learn more
    • Merely users in your arrangement
      • People with Managing director access to a shared drive can motility files from that shared bulldoze to a Drive location in a unlike organization.
      • Users in the selected organizational unit or grouping can motion content from their My Drive to a shared drive owned by a unlike organization.
    • No one
      • Files on a shared drive cannot be moved to a Drive location in a different organization.
      • No one in the selected organizational unit or group tin can move content from My Drive to a shared bulldoze endemic by a different organisation.
      • No one in the selected organizational unit or group tin can create files on a shared drive endemic by another organisation.
  6. ClickRelieve.

Important: If y'all select a kid organizational unit or group, this setting just controls moving content from someone's My Drive to a shared drive in a different organization (for case, another business or schoolhouse). If the peak-level organizational unit permits the user to share files outside their organization, but the kid organizational unit does not, the user tin can't share files exterior their organization.

It can take up to 24 hours to encounter changes. During this time, quondam and new settings might be intermittently enforced.

Prepare file-sharing permissions

Fix permissions for your organization

Shared drives utilise the top-level organization settings. For example, if external sharing is disabled for a user'south organizational unit just immune at the top-level organization, the user can share documents in shared drives with people outside the company or schoolhouse.

Admins can define additional restrictions for each organizational unit using the default settings for the creation of new shared drives. A shared bulldoze'due south restrictions tin't be broader than the superlative-level organization's restrictions. Only you can use the default settings to further restrict admission for shared drives created in specific organizational units.

Share all files and folders in a shared drive

Add members to a shared drive to grant access to files in the shared drive.

Go to Shop and share files with shared drives for more information.

Share a specific file

Shared bulldoze members can too share specific files with people who aren't members of the shared drive.

Go to Share files outside of shared drives for more information.

Was this helpful?

How can we amend it?