A cloud-storage permissions audit should answer three questions for every important file or folder: who can reach it, how they received access, and what they can do. Review direct grants, group membership, inherited folder access, organization-wide settings, external guests, and sharing links. Then compare each grant with a named business need and remove or narrow anything that is no longer required.
Define the scope and inventory access
Start with high-value folders, shared drives, team libraries, and externally shared items. Export or record the owners, direct users, groups, service accounts, public or organization links, and role level for each item. Include inherited access from parent folders and higher rights granted on a child item. Google explains that files in a shared folder receive the folder's access and may keep higher access explicitly granted to a particular file. Microsoft's Manage Access panel separates people, groups, and links, which is useful because a link can reach a different audience than a direct invitation.
Compare permissions with actual duties
For every principal, record whether the work requires viewing, commenting, editing, sharing, deleting, or ownership. NIST defines least privilege as granting only the minimum resources and authorizations needed to perform a function. In practical terms, an editor who only reads reports should become a viewer, an inactive contractor should be removed, and an anonymous link should be replaced with named access when public reach is unnecessary. Do not overlook groups: validate their current membership instead of assuming the group name is accurate.
Google's Drive folder-sharing documentation explains inherited folder permissions and the Viewer, Commenter, and Editor roles. Microsoft's OneDrive and SharePoint access guide shows how Manage Access lists people, groups, and links and supports changing or stopping access. These product records should be the evidence for the audit, not a separate spreadsheet that may be stale.
Remediate in a controlled order
Create a change list before modifying access. Preserve at least one accountable owner, replace broad links, reduce excessive roles, remove departed users, and review service or application identities separately from human accounts. Note any child item with an exception to its parent. For sensitive data, coordinate removals so a legitimate workflow is not silently broken. Record the old permission, new permission, reason, approver, and time.
Test and retain evidence
After each batch, test with representative authorized and unauthorized accounts. Confirm that intended viewers can open but not edit, editors can perform the required task, removed users can no longer reach the item, and old links no longer grant access. Save the native access report or screenshots and schedule the next review. The audit is complete only when the live permissions match the approved access matrix and the result has been tested.
Sources
- Share Folders in Google Drive — Google
- See who a file is shared with in OneDrive or SharePoint — Microsoft Support