How to Audit Cloud Storage Sharing Permissions: A Step-by-Step Guide

Why Permission Audits Matter

Cloud storage permissions accumulate over time. Files are shared for a project, the project ends, and the shares remain. External contractors are invited to a folder, the engagement closes, and the invitation is never revoked. An employee creates an "anyone with the link" share for a quick handoff and forgets about it. None of these events trigger an alert. Each one persists indefinitely unless someone actively looks for it.

A permission audit is the process of systematically reviewing who has access to what, verifying that access is current and appropriate, and removing access that is no longer justified. Done regularly, it converts a continuous source of passive exposure risk into a manageable control.

Before auditing, it is worth understanding the underlying risks that the audit is designed to address. The companion article on cloud storage security risks covers twelve specific risks in detail, including the risk categories that permission audits directly address. The article on cloud storage vs document management is relevant if the audit reveals governance gaps that exceed what cloud storage configuration can address.

Step 1: Define Audit Scope

A permission audit without defined scope can expand indefinitely. Before starting, specify:

• Which platforms are in scope (Google Drive, OneDrive, Dropbox, SharePoint, or all)
• Which users are in scope (all users, a specific department, or all users with external sharing rights)
• Which content is in scope (all content, or only folders/drives classified as confidential)
• What time period the audit covers (shares created in the past 12 months, or all existing shares)
• Who is conducting the audit and who will approve findings
• What the audit timeline is and when remediation must be complete

For a first audit, focus on the highest-risk categories: files or folders shared with anyone (public links), files shared with external users, and files owned by former employees. These three categories typically account for the majority of meaningful exposure.

Step 2: Inventory Users and Storage

Before reviewing individual file permissions, establish a baseline inventory:

• Total number of user accounts (active and suspended)
• Number of external guest accounts
• Number of accounts with administrative privileges
• Total storage in use and how it is distributed across users
• List of all Shared Drives / Team Folders / SharePoint sites in scope
• List of service accounts or non-human accounts with access

This inventory is the foundation for all subsequent steps. In Google Workspace, the Admin Console provides user reports and drive storage summaries. In Microsoft 365, the Microsoft 365 admin center and SharePoint admin center provide user and site inventory. In Dropbox Business, the admin console shows team member listing and storage usage.

Cross-reference active user accounts against your current HR records. Any account belonging to a person who is no longer with the organization should be flagged for immediate review.

Step 3: Identify Sensitive Files

Not all files carry equal risk if overexposed. Before reviewing sharing arrangements, identify which content is sensitive enough that inappropriate access would constitute a significant problem. Common categories include:

Mark these folders in your audit worksheet as high-priority. Any inappropriate access to these folders should be treated as a critical finding requiring immediate remediation.

Step 4: Find Public or "Anyone with the Link" Permissions

Public permissions — shares accessible to anyone with the URL — are the highest-priority finding in most audits because they require no authentication and can be discovered by search engines, data brokers, or anyone who receives the link by any means.

In Google Workspace, administrators can access sharing reports from the Admin Console that list files shared with "Anyone with the link" at the domain level. In Microsoft 365, the SharePoint admin center provides "Anyone links" reporting. In Dropbox Business, the admin console sharing report lists public links created by team members.

For each public share found, determine:

• What content is the link pointing to?
• Who created the link and when?
• Was the share intentional and is it still needed?
• Does the content qualify as sensitive under Step 3?

Unless a public link is clearly intentional and appropriate (a public document, a marketing asset, a support resource), the default action should be to convert it to a restricted share or revoke it.

Step 5: Review External Guests

External guests are users outside your organization who have been explicitly invited to shared folders or drives. They are distinct from public link access — they require an invitation and typically sign in to access the content. However, they represent access that persists even after the business relationship ends.

Generate a list of all external guests from your admin console. For each:

• What is their organization and role?
• When were they invited and by whom?
• What content do they have access to?
• Is the business relationship that justified this access still active?
• When did they last access any shared content?

For any external guest where the business relationship has ended or where the last access date suggests the account is inactive, remove access. If the relationship is ongoing, confirm the current access level is appropriate and set a calendar reminder for the next review date.

Step 6: Check Group Access

Cloud storage platforms frequently use groups or distribution lists to grant access to multiple users simultaneously. A folder shared with "All Employees" or "Marketing Team" gives access to everyone in that group, including people who join the group after the share was created. Group-based access can expand silently as new members are added.

Audit shared folders that use group access rather than individual user access. For each group share, verify: (1) the group membership is current and appropriate for this content, (2) new members added to the group in the past quarter actually need this access, and (3) the access level (view, comment, edit) is the minimum required.

Pay particular attention to organization-wide groups (equivalent to "all users") and distribution lists that may include former employees or automated service accounts that have not been cleaned up.

Step 7: Understand Inherited Permissions

In hierarchical storage systems (SharePoint sites with subsites, Google Shared Drives with nested folders, Dropbox nested shared folders), permissions often inherit from parent structures. A user with edit access to a parent folder may have inherited edit access to all subfolders, including subfolders containing more sensitive content than was present when the original share was created.

Document the permission model for your primary storage structure: which folders inherit from parents, and which have their own explicit permission sets. Review any sensitive folders to confirm whether their permissions are explicitly set or inherited. If a sensitive folder inherits broad access from a parent that has general organizational access, consider breaking the inheritance and setting tighter explicit permissions on the sensitive folder.

Step 8: Review Ownership and Departed Employees

Files owned by departed employees present a specific risk. If the departed employee's account is still active (or if external guests retained access through their shares), the content may remain accessible even after the person left. Additionally, files without a current active owner may be at risk of inadvertent deletion or modification without accountability.

Cross-reference your file ownership list against current employee records. For any files owned by accounts of departed employees: (1) transfer ownership to a current employee or shared drive, (2) review the access permissions on those files, and (3) confirm the account has been disabled in the identity provider. Set up a process to include this step in every future employee off-boarding.

Step 9: Stale Shared Links

Shared links — whether "anyone" or restricted to specific people — created for one-time use frequently remain active indefinitely. A link shared for a client deliverable six months ago may still be functional and pointing to a folder that has since been updated with additional sensitive content.

Review existing shared links and identify those created more than 90 days ago (or whatever threshold is appropriate for your business). For each: was the original purpose of the share completed? Has the content changed since the link was created? Should the link have an expiration date? Where platforms support link expiration, set expiration dates at link creation as a matter of policy rather than cleaning up stale links retroactively.

Step 10: Third-Party App Access

Connected third-party applications with OAuth access to cloud storage are not visible in sharing reports — they appear in OAuth or connected-apps listings rather than sharing permission lists. But they represent the same category of access risk: an application that can read all files in a Drive account has broader access than most individual shared links.

Review the connected applications list in each platform's admin console. For each application: Is it still in active business use? What permission scope does it have (read all files, write all files, or specific folder)? Is the application vendor reputable and their security posture acceptable? Revoke access for inactive, unrecognized, or disproportionately scoped applications.

Step 11: Confirm Audit Log Availability

Before completing the access review, confirm that audit logs are available, accessible to you, and cover the period in scope. This step both confirms your detection capability and provides evidence that the review was conducted.

Specifically verify: (1) how many days of audit history are available at your current plan tier, (2) whether you can filter logs by sharing events and external access events, (3) whether the logs are exportable for documentation, and (4) whether any access events since your last review indicate suspicious activity (bulk downloads, access from unusual locations, access at unusual hours). Document the audit log availability period in your findings report.

Step 12: Remediation

Remediation is the process of acting on audit findings. Prioritize by risk severity:

• Immediate (same day): Public links to sensitive content, active accounts belonging to departed employees, unrecognized external guests with access to sensitive folders
• High priority (within 48 hours): All other public links, stale external guest access, OAuth apps with broad scope that are no longer in use
• Standard (within one week): Group access reviews, overly broad permissions on non-sensitive folders, missing link expiration dates

Before removing any access, verify that the content owner or responsible manager has been informed and agrees with the change. Removing access without notification can disrupt active business processes. Document each remediation action: what was changed, by whom, and when.

Step 13: Post-Remediation Testing

After remediating identified issues, verify that the changes took effect. For high-priority remediations (public links revoked, external guest access removed), conduct a brief test:

• For a revoked public link: attempt to access the link in an incognito browser to confirm it no longer works
• For a removed external guest: confirm the user no longer appears in the sharing list
• For a revoked OAuth app: confirm the app no longer appears in connected apps

Document the test date and result for each high-priority remediation. This creates evidence that the issue was resolved, which is important for compliance reporting.

Step 14: Document Findings

Create a written audit record that includes: audit scope and date, who conducted the audit, total accounts and shares reviewed, summary of findings by category (public links, external guests, stale access, app access, ownership issues), remediation actions taken with dates, any findings that could not be remediated and the reason, and the next scheduled review date.

This documentation serves multiple purposes: it demonstrates due diligence for compliance purposes, it provides a baseline for comparison in future audits, and it creates institutional memory that survives team changes. Store the audit record in a secured location with limited access.

Step 15: Schedule Follow-up Reviews

A permission audit is only useful if it is repeated regularly. The access problem recurs: new external shares are created, new contractors are invited, new applications are connected. Schedule the next audit before closing the current one. For most organizations, quarterly is the appropriate cadence. For those with high external-user turnover or compliance obligations, monthly reviews of the highest-risk categories (public links and external guests) are more appropriate.

Additionally, trigger an immediate unscheduled review when: an employee departs unexpectedly, a security incident occurs anywhere in the organization, a contractor engagement ends, or a significant change is made to the cloud storage structure. These events are the highest-risk moments for access gaps to develop.

Platform Differences: Google Workspace, Microsoft 365, Dropbox Business

While the audit process is the same across platforms, the administrative tools for each platform are different. The following describes the conceptual location of the key reports for each platform. Specific menu paths change with platform updates; refer to current vendor documentation for exact navigation.

Audit Worksheet

Use this worksheet to document each finding during the audit. Create one row per significant sharing arrangement or access finding. Illustrative example rows are included in italics.

Example rows are illustrative only. Populate with your actual audit findings.

Pass/Fail Criteria

Quarterly Review Checklist

Use this abbreviated checklist for ongoing quarterly reviews after the initial full audit is complete:

For a broader view of the file security controls that this audit feeds into, the enterprise file sharing security checklist covers the full set of controls relevant to organizations managing sensitive files.

Frequently Asked Questions