Shared Drive (and Google Group) Manager and Owner permissions

[alexgrutza]

Is there a way using EDU Fund. that we can restrict Managers (Drive) and Owners (groups) to only be our domain, but still allow external members/viewers?

We had a situation where someone added an external gmail account as a manager, and ended up uploading TB's of data to nearly max out our pool of storage. 

So the goal is to restrict owners/managers to only be users within out domain, but still allow external members (we're higher edu).

Or will we have to rely on GAM to run periodically to remove owners/managers who are not within our domain?

[icrew]

What we do to address this for Shared Drives is to set things up so that:

a) Only professional (non-student) employees can create new shared drives.

b) any new Shared Drive has a 25GB quota, and the managers need to submit a ticket to get more. 

That really minimizes our risk. 

[alexgrutza]

How would you handle a situation where a professional employee were to share with a gmail account as a manager? I believe we may run into issues where in order to move files around shared drives, the external person has to be a manager anyways, so it may not even be possible (ie. external vendors/consultants)

I like and agree with your strategy, but some people in our department may think addressing creation of shared drives to be too ticket-intensive... I will present your strategy as a maybe-solution and see what others say.

[icrew]

Honestly, given that Shared Drives default to 25GB, we don't really care if external folks have manager access, as the risk is sufficiently small. And we don't create Shared Drives for folks via ticket, they can create their own. It's just that the default OU for new Shared Drives has a 25GB quota, and the list of who can create a shared drive is restricted to a Google Group that's kept up to date with only our professional employees.

[alexgrutza]

Thanks Ian I am going to pass this information along to higher ups. The default OU you mention is just the root OU correct? I didn't see a way to default the OU for created shared drives.

[icrew]

See the second screenshot at https://workspaceupdates.googleblog.com/2022/05/shared-drives-in-organizational-units-open-beta.html

[alexgrutza]

Wonderful thank you!

[kaned]

We had a Google Workspace audit done and have set up quotas for shared Drives.  Not hard to do once you read the doc linked above from @icrew .

I looked through data classification and context aware access and I don't think that the ACL's can be used as conditions.  Unless someone knows better, I don't believe there is any way to limit the ACL/share of a drive.  

I think there are other services like managed methods that would do this if gam scripting was not an option.

[alexgrutza]

Yeah and we're EDU Fund. so i don't know that we get Context aware access, and i'm not sure about data classification. 

I'm thinking GAM is the only tool, but it will get confusing when we have legit external vendor entities needing Manager permission on a Share Drive (or subfolder) in order to perform work.. 

[Josh]

In addition to the options already suggested (Changing OUs/policies) and GAM/API. You can use the Admin Console to create alerts when ever the specific settings you want to monitor are changed.

EG, Create an alert when the sharing settings on a drive are changed, the sharing level is X and the target user's domain is not your domain. You would need to manually review and action these, but it will only prompt when the criteria is met.

I am unsure if this requires paid Workspace licences or not.

[sleeciambra]

We don't allow anyone (including staff) to create Shared Drives anymore. We had hundreds of shared drives, some of which contained nothing or one document and trying to keep up with changing staff on curriculum drives was impossible because we had no idea what was actually in use. Now we have two shared drives per department: one that's private/internal and one with documents that can be public and shared externally. All of them have storage quotas and IT are the managers. Once a year, I review the content managers on each drive and update as needed but it's a much quicker task now than it was before. The ability to share folders or restrict who has access to folders has been a huge help. I can leave sensitive materials in a shared drive and restrict who can reach it, which means I no longer have to create more drives to house those materials.