Prepare a cloud storage service for a new user by deciding who owns the account, placing shared work in the right location, granting the smallest useful permission, and testing access from the user's actual account. The setup is not complete when an invitation is sent; it is complete when the user can do the intended work and cannot do the work that should remain restricted.
Define ownership and the recovery contact
Record whether the storage belongs to an individual, a household, or an organization. Important shared files should not depend on an employee's personal account or an email address that nobody else can recover. Identify the account administrator, a backup administrator where the service supports one, the billing owner, and the approved recovery channel. Store recovery secrets in an appropriate password manager rather than in the shared drive itself.
Create the user under the intended organization or family structure before moving files. Confirm the display name, sign-in address, time zone, and license or storage assignment. A typo can create a second account that looks plausible but does not hold the intended permissions.
Design the folder structure before sharing
Separate personal working files, team files, reference material, and records that need tighter access. Use names that describe function rather than one person's temporary role. Decide which folders are authoritative and which are copies or exports. If a user will receive access through a group, record the group name and owner.
Permissions inherited from a parent folder can override the intuition that one file is private. Google states that access applied to a folder is inherited by files within it and recommends a limited-access subfolder when an item needs different permissions. Microsoft similarly exposes people, groups, and sharing links through Manage Access. Review the parent before granting access to a child folder. See Google Drive sharing permissions and Microsoft's Manage Access guidance.
Assign the least powerful useful role
Choose viewer, commenter or reviewer, or editor according to the actual task. Do not grant edit access only because it is the fastest default. Google documents that a Drive editor can edit and, by default, share and change permissions, while a viewer cannot edit. Microsoft documents that Can edit may let a person change and share an item, and that folder editors can copy, move, rename, share, or delete content they can access. These details make role selection a workflow decision, not a cosmetic label.
Use specific-person invitations for sensitive material. A broadly usable link can be forwarded. If the service supports link expiration, download restrictions, or external-user limits, decide whether they are appropriate, but do not treat them as a substitute for correct account access.
Configure notifications and desktop sync deliberately
Decide whether the user needs email notifications, a desktop sync client, mobile access, or offline files. Start with the smallest scope. Syncing an entire shared library can consume local storage and place work data on an unmanaged device. Record which folders should be available offline and what happens when the device is lost.
If the user works on a shared computer, check whether the sync client separates profiles and whether sign-out removes local copies. Do not promise that deleting a local file leaves the cloud copy untouched; test the provider's behavior with a disposable sample.
Run a two-account access test
Use one administrator account and the new user's account. From the new account, verify that the user can open an intended file, perform the allowed action, find the file again, and see the correct authoritative folder. Then try one prohibited action, such as editing a view-only file or opening a restricted folder. Record expected and actual results.
Create and delete a harmless test file if the user's role includes those actions. Check the recycle bin or version history so the team knows how mistakes are recovered. Do not test deletion with a real business record. Also verify the experience on any required device rather than assuming browser success proves desktop sync works.
Document the handoff and exit path
Give the user a short map: where active work belongs, how files are named, how sharing requests are approved, what must not be stored, and whom to contact. Include the official service links rather than copied screenshots that will age quickly.
Write the offboarding steps at the same time. They should cover disabling the account, transferring owned files where applicable, removing direct links and group membership, checking local synced copies, and preserving required records. Microsoft notes that Manage Access can stop sharing or change permissions; that is a useful control, but the owner still needs an inventory of direct access, group access, and links.
A good onboarding record lists the user account, administrator, assigned role, approved folders, devices, test results, recovery owner, and review date. Recheck the setup after role changes, reorganizations, or migrations because inherited permissions and shared links can outlive the original reason for access.
Sources
- Share files from Google Drive — Google Drive Help
- See who a file is shared with in OneDrive or SharePoint — Microsoft Support
- Sharing files, folders, and list items — Microsoft Support