A cloud folder permissions review should identify every route into the folder before you remove access: named people, groups, public or organization-wide links, parent-folder inheritance, shared-drive membership, and app integrations. Map those routes, reduce each one to the least access required, and test the result with an account that represents the intended user.
Inventory the folder and its access paths
Start with a defined folder, not an entire cloud account. Record its owner, business or household purpose, sensitivity, parent folder, and the people responsible for it. Open the provider's sharing or Manage access panel and list direct users, groups, guests, and sharing links. Also check whether access comes from a parent folder, a shared drive, a SharePoint site, or a team membership.
Do not treat a short people list as proof that access is limited. Microsoft explains in its OneDrive and SharePoint permissions guide that someone may have access through a link, direct access, or the parent site. Google explains that access applied to a Drive folder is inherited by files inside it. Those alternate paths are why the review starts with an access map.
Match each role to the actual job
For every person or group, ask whether they need to view, comment, edit, organize, delete, share, or change permissions. Prefer the narrowest role that still supports the work. An editor can do much more than a viewer, and folder-level editing can affect many items. Remove former collaborators and obsolete groups. Where the provider supports expiration for an eligible role, set it for genuinely temporary access.
Review general-access links separately. Identify whether a link is restricted to named people, available to an organization or audience, or usable by anyone who receives it. Replace broad links when the work no longer requires them. Microsoft notes that changing a sharing link from edit to view may require deleting the old link and creating a new one, so plan the replacement before removing a link used by an active workflow.
Understand inheritance before changing anything
Google's folder-sharing documentation says files and subfolders inherit permissions from a parent folder, and a child item may retain higher access granted directly. Google's file-sharing guide also distinguishes viewer, commenter, editor, and owner capabilities. If a sensitive item needs tighter access than its parent, place it in a provider-supported limited-access or separately controlled folder rather than assuming a child restriction will override inherited access.
In OneDrive or SharePoint, use Manage access to distinguish people, links, and inherited permissions. Microsoft's guide says inherited access may need to be removed at the parent folder or site. Before altering a parent, identify every other file and team that depends on it. A folder-level correction can unintentionally interrupt unrelated work if its reach is not understood.
Make small changes and verify them
Back up or export an access list when the provider allows it, then change one route at a time. Start with clearly obsolete links and accounts. Record the old setting, new setting, reason, approver, and time. Avoid removing the only owner or the administrator who can restore access. For organizational content, follow the organization's offboarding, retention, and ownership-transfer process.
Test from a private browser window or a separate authorized test account. Confirm that an intended viewer can open but not edit, an editor can perform the required task, and an unauthorized account cannot enter through an old link. Reopen the management panel after testing because a successful page load alone does not reveal every permission route.
Close with an owner and review date
Assign one person to review the folder after staff, household, vendor, or project changes. Put the next review date in the folder index and include links that were intentionally retained. Check newly added files because they may inherit the current folder permissions automatically.
The final checklist should show folder owner, direct users, group access, link scope, inherited access, external guests, role levels, expirations, sensitive subfolders, test results, and the next review date. That record makes later cleanups safer and keeps permissions aligned with real work instead of old assumptions.
Sources
- Share files from Google Drive — Google Drive Help
- Share and manage access to files and folders in Google Drive — Google
- Manage sharing and permissions in OneDrive and SharePoint — Microsoft Support