How to Audit Cloud Storage Sharing Permissions

Table of Contents

1. Before you start: scope and authority
2. Stage 1: Define the audit scope
3. Stage 2: Build the inventory
4. Stage 3: Find the high-risk patterns
5. Stage 4: Verify ownership and need
6. Stage 5: Remediate in priority order
7. Stage 6: Record evidence and set the cadence
8. Platform notes: Google Drive, OneDrive and Dropbox Business
9. Common mistakes
10. Frequently Asked Questions

Before you start: scope and authority

A permissions audit touches people's work. Before you change anything, make sure the audit has a sponsor who can approve remediation decisions, that business owners know a review is happening, and that someone is responsible for emergency changes if a critical exposure is found. Agree in advance how you will handle disputes, such as a team that insists its external sharing is essential.

You also need administrative access that is appropriate for the task. Use a named administrator account rather than a shared login, and where possible use a separate account for audit activity so that the audit trail is clear. Keep your audit notes in a restricted location, because the inventory itself is sensitive: it lists where your confidential files live and who can reach them.

Stage 1: Define the audit scope

Decide what you are auditing before you export anything. A full tenant audit can be large, and a poorly scoped audit produces a report nobody acts on. A practical first audit usually covers:

• All shared drives or team folders that hold finance, HR, legal, client or product data.
• All external sharing from the organization, including guest users and anonymous links.
• All administrator accounts and any account with broad or delegated access.
• All connected third-party applications with access to company files.

Mark the scope in writing. Include the platforms, the date of the audit, the people who approved it and the exclusions, if any. Exclusions are sometimes necessary, for example a public marketing folder that is intentionally open, but each one should have a reason.

Stage 2: Build the inventory

The inventory is the list of every item and every grant that you will evaluate. For each shared item, you need at least the following fields:

Each platform offers different ways to collect this data. Administrative reports, audit exports and API-based tools can all produce inventories, and the right method depends on the size of your tenant and the tools you have. For a small organization, a documented manual review of the most sensitive folders may be a sensible start. For larger environments, use an export tool or a reporting capability that your licence supports, and validate the output against a few folders you know well. An inventory that misses known shares is worse than no inventory, because it creates false confidence.

Stage 3: Find the high-risk patterns

Once you have the inventory, filter for the patterns below. Work through them in order, since each one carries a different level of exposure.

Pattern A: Anyone-with-the-link items. These are the highest priority in most environments because the link can be opened by anyone who obtains it, and the link may be discoverable through forwarding, indexing or leaked messages. Any sensitive item with an unrestricted link should be treated as a finding.

Pattern B: External shares of sensitive folders. A folder shared with an external domain or individual is not automatically wrong, since many businesses collaborate with clients and suppliers. But external access to finance, HR, legal or confidential product folders needs an explicit business reason and a named owner.

Pattern C: Guest accounts without a current project. External users or guests who were invited for one project may still have access to other content. Filter guests by last sign-in or last activity where your platform provides it, and list the shares each guest can reach.

Pattern D: Orphaned shares. A share is orphaned when its owner has left the organization, or when the folder's owner no longer exists in the identity provider. Orphaned folders can continue to be shared, and no one is responsible for responding to requests to change their settings.

Pattern E: Overprivileged users. Look for editors or managers on folders where the role should be viewer, for individuals with access to a folder their job does not require, and for groups that are broader than intended, such as "all staff" applied to a restricted folder.

Pattern F: Unmanaged or unfamiliar connected applications. Review third-party apps with access to files. Look for applications that nobody recognizes, that have broad read or write scopes, or that have not been used in a long period.

Stage 4: Verify ownership and need

A finding is not a decision. Before you remove access, verify it. For each high-priority item, identify the business owner, contact them, and ask three questions: is the sharing still needed, who should have access, and what happens if access is removed for a short period?

Record the answers. A typical response might confirm that an external client needs view access to a specific contract folder until a set date. Another might say the share is stale and can be removed immediately. Some findings will require a deeper conversation, such as a project where several teams share sensitive files in an informal way. Use those conversations to improve the process, not only to close the ticket.

For orphaned shares, the owner question is different. You may need to reassign ownership to a current manager, which is typically done by an administrator in the platform's admin tools. Avoid deleting an orphaned folder before you have confirmed that no one needs its contents.

Stage 5: Remediate in priority order

Remediate findings in an order that reduces the largest risks first. A sensible order is:

1. Remove anyone-with-the-link access from sensitive items that have no current business justification.
2. Remove or restrict external access to sensitive folders where the external party no longer needs it.
3. Remove access for departed users and reassign orphaned ownership.
4. Remove guest accounts and external shares that are not tied to an active project.
5. Reduce overprivileged roles, for example converting editors to viewers where editing is not required.
6. Revoke unused third-party application grants.
7. Address lower-risk items such as stale internal shares and unused groups.

Where you change a folder's sharing, notify the owner and document the change. Some changes will break workflows. Prepare for those calls, and keep a rollback note with the previous setting so that you can restore access quickly if a legitimate need is confirmed.

Consider a remediation approach that uses groups rather than individual grants. When access is granted through a group, membership changes update access in one place, and the audit becomes easier to repeat.

Stage 6: Record evidence and set the cadence

An audit is valuable when it can be repeated and when its results can be shown to auditors, customers or leadership. Record the scope, the date, the inventory, each finding, the decision taken, who approved it and the date of remediation. Keep the record with your access review documentation.

Set a cadence. Sensitive folders and administrator accounts should be reviewed at least quarterly. Broader reviews can be semi-annual or annual depending on your risk profile. Trigger an additional review after significant events, such as a staff departure from a senior role, a client project ending, a platform migration or an incident.

Measure progress. Useful indicators include the number of anyone-with-the-link items on sensitive content, the number of external shares older than a set threshold, the number of orphaned items, and the time to close a high-priority finding.

Platform notes: Google Drive, OneDrive and Dropbox Business

Vendor interfaces change, so verify the exact menu paths in the current administrator documentation for your edition. The notes below describe where to look rather than the exact clicks.

Google Drive. Use the Google Workspace Admin console's reporting and audit areas to review Drive activity, including sharing events. Google also provides investigation tooling for Drive data in the Admin console on eligible editions, which can help identify files and their sharing state at scale. Check domain-level sharing settings separately, because they define what users are permitted to do. For shared drives, review the members and their roles, and confirm that each shared drive has an owner. Review link sharing settings at the organization level and the individual file level. Consult the Google Workspace Admin Help for current procedures.

OneDrive and SharePoint. Microsoft 365 administrators use the SharePoint admin center for tenant-level sharing settings and reports, and they can review site-level sharing and permissions. Audit log search in Microsoft Purview can show sharing and access events, subject to the retention period for your licence. PowerShell tools for SharePoint Online can list sites, external users and sharing details, and can be used for larger tenants. For a guest review, identify external users, the sites they can reach and the last time they accessed content where that information is available. Documentation is available on Microsoft Learn and in the Microsoft Purview documentation.

Dropbox Business. Use the Dropbox Admin Console to review team members, team folders, shared links and sharing activity, subject to the reports available on your plan. Review shared folders and their members, and check whether links are password-protected or expire. Dropbox provides audit logs on business plans, and you should confirm the retention period and export options for your tier. Consult the Dropbox Help Center for current instructions.

Common mistakes

Several errors appear repeatedly in permission audits.

Auditing only the top folders. Sensitive content often sits in unexpected places, such as personal drives that were shared with a team or a shared folder created for a short project and never closed.

Removing access without asking. A quick deletion can disrupt a client deliverable or a regulatory submission. Verify before changing anything that is actively used.

Treating an export as the finished audit. An inventory is the input. The value comes from the decisions and the follow-up.

Forgetting the links. Permission reviews that look only at named users can miss public and anyone-with-the-link content, which is often the most dangerous exposure.

Ignoring applications. Connected apps can read as much as a user does, and they often outlive the people who installed them.

Not repeating the audit. A one-time clean-up degrades quickly. Set the cadence before the first audit concludes.