How to Configure Shared Drives, Manager Permissions, and External Sharing Restrictions in Google Drive

Modern enterprise file collaboration requires centralized asset ownership, persistent storage boundaries, and resilient access controls. In traditional consumer-grade cloud storage models, individual employee accounts own specific documents. When a team member departs the organization, their personal account deprovisioning risks unlinking critical corporate documents or inadvertently destroying shared institutional knowledge. Google Workspace Shared Drives (formerly Team Drives) solve this structural challenge by decoupling document ownership from individual identity, binding file ownership directly to the organizational domain.

However, deploying Shared Drives without establishing clear permission tiers, access inheritance structures, and perimeter boundary protections introduces substantial security risks. Unrestricted members may inadvertently invite external contractors, share sensitive corporate roadmaps via public web links, or download confidential intellectual property onto unmanaged personal devices. This guide provides an operational blueprint for configuring Google Drive Shared Drives, structuring managerial and contributor permissions, enforcing sharing restrictions, and administering domain-wide policies via the Google Workspace Admin Console.

Architectural Overview: My Drive vs Shared Drives Storage Model

Understanding the fundamental distinction between individual storage containers and organizational Shared Drives is vital for compliance and disaster recovery:

Operational Metric	Standard “My Drive”	Google Workspace “Shared Drives”
Asset Ownership	Bound to the individual Google Account creator	Bound to the organization/domain; independent of any single user
Lifecycle upon User Deletion	Files are transferred via admin console or deleted permanently	Files remain intact, accessible, and unaffected by user offboarding
Permission Inheritance	Folder-by-folder or explicit file permissions	Top-down inheritance; root access propagates down the tree
Move Restrictions	Files move freely between directories	Moving files across Shared Drive boundaries requires Manager rights
Storage Quota Impact	Counts against individual user’s Google One quota	Counts against tenant-wide pooled enterprise storage allocation

Prerequisites and Environment Requirements

• Google Workspace Tier: Business Standard, Business Plus, Enterprise Standard/Plus, or Education Fundamentals/Plus editions. (Shared Drives are not available on legacy free editions or personal consumer accounts).
• Administrative Privileges: Super Admin or delegated Drive & Docs Administrator access for tenant-level controls; Manager role for individual Shared Drive management.
• Modern Web Client: Supported browser (Google Chrome, Microsoft Edge, Safari, Firefox).

Step 1: Creating a Shared Drive and Structuring Member Roles

Shared Drives enforce five discrete permission levels, each granting specific capabilities across the folder hierarchy:

1. Navigate to Google Drive (drive.google.com) and sign in with your corporate Workspace identity.
2. In the left-hand navigation panel, click Shared drives.
3. Click + New in the top-left corner, enter a naming convention (e.g., [SEC] InfoSec-Auditing-2026 or [MKT] Brand-Assets), and click Create.
4. With the new Shared Drive selected, click Manage members in the top-right toolbar.
5. Add individual email addresses or target a designated Google Group (recommended for scalable team administration).
6. Assign the appropriate role from the dropdown menu based on least-privilege principles:
   • Manager: Full administrative rights. Can add/remove members, adjust drive security settings, move folders across drives, and delete the Shared Drive.
   • Content manager: Default operational role. Can add, edit, move, and trash files. Cannot alter membership or security configurations.
   • Contributor: Can create and edit files, but cannot move or trash existing files. Ideal for junior staff and external contributors.
   • Commenter: Read-only access with the ability to add feedback comments and suggestions.
   • Viewer: Strictly read-only access. Cannot comment, edit, or manipulate assets.
7. Click Send to dispatch invitations and bind access.

Step 2: Enforcing Granular Shared Drive Security Settings

Each Shared Drive contains independent security policies that override user actions to prevent data leakage:

1. Open the target Shared Drive, click the drive name at the top of the file view, and select Shared drive settings.
2. Review and configure the three primary perimeter boundaries:
   • Sharing outside your organization: Uncheck “Allow people outside [Organization] to access files” for confidential internal drives. When disabled, users cannot invite external Gmail or guest accounts.
   • Sharing with non-members: Uncheck “Allow people who aren’t shared drive members to be added to files”. When disabled, contributors cannot share individual child documents with colleagues outside the pre-approved member roster.
   • Download, copy, and print protections: Check “Prevent viewers and commenters from downloading, copying, and printing”. This disables right-click copy actions, print menus, and local offline downloads for sensitive IP.
3. Click Apply to commit the security sandbox.

Step 3: Managing Folder-Level Permissions within a Shared Drive

While top-level Shared Drive membership cascades down to all contained items, Google Drive supports expanding access on specific subfolders for cross-functional collaboration without exposing root structures:

1. Navigate inside the Shared Drive to a specific subfolder (e.g., Public-Whitepapers).
2. Right-click the subfolder and select Share.
3. Add the external collaborator or non-member team.
4. Assign their role (e.g., Viewer or Editor).
5. Note that folder-level permissions can only elevate access, never restrict it. For example, a user who is a Content manager at the root cannot be downgraded to a Viewer on a subfolder; their root privileges always take precedence.

Step 4: Domain-Wide Shared Drive Governance via Admin Console

Google Workspace Super Administrators can govern Shared Drive creation privileges, external boundaries, and compliance defaults centrally:

1. Log in to the Google Workspace Admin Console (admin.google.com).
2. Navigate to Apps → Google Workspace → Drive and Docs.
3. Click Sharing settings → Shared drive creation.
4. Select your target Organizational Unit (OU) on the left panel (e.g., Contractors or Full-Time Staff).
5. Under Prevent users in [OU] from creating new shared drives, check the box to restrict Shared Drive proliferation strictly to IT or project leads.
6. Under Default Shared Drive Settings, enforce whether external file sharing is permitted globally across all newly provisioned Shared Drives in that OU.
7. Click Save.

Permission Capabilities Matrix

Operational Capability	Manager	Content Manager	Contributor	Commenter	Viewer
View files and folders	Yes	Yes	Yes	Yes	Yes
Add comments and suggestions	Yes	Yes	Yes	Yes	No
Create and edit files	Yes	Yes	Yes	No	No
Move files within the drive	Yes	Yes	No	No	No
Delete files (Trash)	Yes	Yes	No	No	No
Manage members & drive settings	Yes	No	No	No	No
Permanently delete Shared Drive	Yes	No	No	No	No

Troubleshooting Common Shared Drive Issues

Issue 1: “You cannot move folders into a Shared Drive” Error

Root Cause: Moving entire folders from personal “My Drive” into a Shared Drive alters asset ownership. Google Drive requires the user performing the move to be both an Editor of the source folder and at least a Manager of the destination Shared Drive.

Remediation: Elevate the user’s role on the destination Shared Drive to Manager temporarily, or move items into the Shared Drive using individual file selections rather than top-level folder trees.

Issue 2: “Sharing outside of organization is disabled” Banner When Adding Guest

Root Cause: The individual Shared Drive settings have “Allow people outside organization” toggled off, or the Workspace Admin Console has enforced a domain-wide restriction on the parent Organizational Unit.

Remediation: Check Shared drive settings at the root of the target drive. If the checkbox is greyed out, access the Google Workspace Admin Console under Drive & Docs → Sharing settings → Sharing outside of [Organization] and ensure external sharing is permitted for the OU containing the Shared Drive creator.

Issue 3: Files Trashed by Mistake Cannot Be Restored by Contributors

Root Cause: Contributors lack deletion privileges and cannot interact with the Shared Drive Trash bin.

Remediation: A user with Manager or Content manager permissions must open the Shared Drive, click the Trash view in the left sidebar, locate the file, right-click, and select Restore within 30 days of deletion.