Synchronize users and groups.
Use directory records to identify the people involved in an access review.
Google WorkspaceGoogle Workspace security: review Drive sharing and app access.
Bring users and groups into your review. With the separate Google security connection, investigate supported OAuth grants and Drive sharing, ask the owner what access is still needed, and apply eligible changes.
Directory sync · Separate grant for app and Drive security
Capabilities
What this integration covers.
Find unnecessary app access.
Review supported third-party OAuth grants and revoke access your team no longer needs.
Resolve overshared files.
Ask the file owner for context, then remove an eligible Drive permission or selected external recipients across up to 100 files at once through Elba and check the result.
Native controls
Where Elba fits alongside Google Workspace controls.
Content policies, sharing settings and a file owner’s decision answer different questions. Start with the native controls you have, then evaluate how Elba supports the review and eligible correction.
| Control or workflow | Question it helps answer | What to evaluate |
|---|---|---|
| Native Drive DLP | Does supported content match a configured data policy? | Check Google’s current edition and rule requirements. Elba is not a replacement for native DLP.Google’s DLP documentation |
| Native sharing controls | Which audiences may receive access under your organization policy? | Check the policy alongside the file’s current permissions.Google’s sharing guidance |
| Elba sharing review | Does this supported exposure still serve a business need? | Review a finding with its owner, select an eligible correction and check the result. |
Example workflow
Take a Drive sharing issue through review and correction.
How the integration supports a specific security task.
- 01
Find the sharing to review
Start with recorded Drive sharing by an external recipient domain, inspect its addresses and files, and check source and observation limits. Open an eligible sharing finding before considering a correction.
- 02
Review with the owner
Confirm which collaborators still need access and which sharing can change.
Apply and verify the change
Use an eligible permission-removal action. Check its result and record remaining access paths or anything still unresolved. A requested change is not proof that all access has gone.
Demo agenda
What to check in a Google Workspace demo.
- Which directory and security-source grants your workspace needs, with the current permissions and coverage boundaries.
- How to go from an external recipient domain to recorded addresses and files, then bring an eligible sharing finding and its owner into a decision. Recorded observations are not a complete check of current access.
- Which eligible action can change the permission, how its result is checked and how unresolved access is handled.
- How supported third-party OAuth grants can be reviewed separately from file sharing.
Agree a representative scenario with our team. Availability depends on the connection, object and workspace configuration; inherited or unsupported access may need a change in Google. The demo does not require making a change to your production files.
Practical guides
Related capability
Explore this part of the platform.
Before you connect
Coverage, permissions, and requirements.
Directory sync is the base connection. OAuth and Drive security require a separate grant and enabled workspace capabilities. Review the live scopes and eligible actions before connecting.
Explore security & privacyWhich Google role is required?
Use a Google Workspace Super Admin. Only that role can grant the domain-wide delegation required by the setup flow.
Does connecting the directory automatically inspect Drive?
No. Directory synchronization is separate from the Google security-source grant used for supported OAuth-grant and Drive workflows.
Can elba revoke every OAuth grant or Drive permission?
No. Direct changes apply only to supported grants, permissions and objects exposed as eligible by the live connection.
Can Elba remove selected Drive recipients in bulk?
Yes. For eligible Drive sharing findings, Elba supports surgical removal of selected external recipients across up to 100 files in a single workflow while preserving approved internal collaborators.
Where should administrators verify requested access?
Review the scopes displayed in elba and the live Google Admin delegation entry. Those current screens take precedence over copied or older scope lists.
Coverage and requirements
- The base directory connection does not by itself enable OAuth-grant or Drive security analysis.
- Google uses separate grants for sign-in, directory synchronization, security analysis and optional capabilities.
- The Drive scope is broad; review the live delegation entry and provider authorization details before approval.
- Available findings and actions vary by workspace configuration, source state and object type.
Other applications
Review more integrations.
Discuss your requirements
Evaluate Elba for your Google Workspace sharing review.
Walk through a supported sharing finding, the owner’s decision and the evidence to check after an eligible correction. Confirm your required grants and coverage before choosing the next step.