> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/external-collaborator-sharing/google-drive-playbooks-for-external-sharing.md). # Google Drive playbooks for external sharing To mitigate the risk associated with external sharing in Google Drive, you can define automated workflows for these use cases: * [Remediate external sharing with 3rd party vendors](#remediate-external-sharing-with-3rd-party-vendors) * [Remediate external over-exposure with a loop function ](#remediate-external-over-exposure-with-a-loop-function) * [Remove external sharing](#remove-external-sharing) * [Remove external collaborators and restore after approval](#remove-external-collaborators-and-restore-after-approval) * [Remove external collaborators on-demand](#remove-external-collaborators-on-demand) * [Remove collaborators from a specific domain on-demand](#remove-collaborators-from-a-specific-domain-on-demand) * [Remediate external sharing of PII](#remediate-external-sharing-of-pii) * [Remediate external sharing of files having sensitive Google labels](#remediate-external-sharing-of-files-having-sensitive-google-labels) * [Auto-expire external sharing with private accounts](#auto-expire-external-sharing-with-private-accounts) * [Remediate external sharing of sensitive content](#remediate-external-sharing-of-sensitive-content) * [Remediate external sharing of sensitive Regex content](#remediate-external-sharing-of-sensitive-regex-content) * [Remediate external sharing if user has active alerts](#remediate-external-sharing-if-user-has-active-alerts) * [Notify when non-admin users move files outside the organization](#notify-when-non-admin-users-move-files-outside-the-organization) * [Remove internal and external collaborators on-demand](#remove-internal-and-external-collaborators-on-demand) {% hint style="info" %} See the DoControl [demo video](https://youtu.be/x9ayyk05BjA) to configure auto-expire external sharing of files in Google Drive. DoControl's best practices will help you to minimize data overexposure, and mitigate the risk of data loss. {% endhint %} ## Remediate external sharing with 3rd party vendors To mitigate the risk associated with externally sharing with a 3rd party vendor in Google Drive, you can define automated workflows to remove external collaborators. This is done when at least one collaborator is not from your trusted domains, and new collaborators with private email domains were added. {% hint style="info" %} When an asset exists in a parent folder, collaborator access is removed from all assets in the folder. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to the Google Drive app, and select the **Remediate external sharing with 3rd party vendors** playbook. 3. Give the workflow a description. 4. Under the **Change user access** event, the relevant conditions are already pre-populated: * **Collaborators not in trusted domains** - At least one collaborator is **not** in your trusted domains * **New collaborators were added** -`Has added collaborators` condition is true.

5. Add any relevant conditions. 6. The **Array filter** action is pre-populated to filter for added collaborators who are from private email domains. 7. The **Conditional** action is pre-populated to determine if there are collaborators who have a private email address. * If **true**: The **Remove collaborator** action removes all collaborators with a private email address. The **Notify in Slack** action sends a message to the actor, informing him/her that sharing the asset with collaborators who are not in the vendor list is not allowed, and that sharing links have been removed. * If **false**: Continue with the steps below. 8. The **Notify in Slack** message sends a message to the actor saying that sharing is allowed but is time-limited. 9. Customize the **Wait** action for how long to wait until sending an Approval request. 10. Customize the Approval action to send to the actor: Do you approve sharing this asset for another month? * If **yes**: A **Notify in Slack** message is sent to the actor notifying them that sharing has been extended. * If **no** or **timeout**: The Remove collaborator action is pre-populated to remove external collaborators. Customize the error handling step.\ A **Notify in Slack** message is sent to the actor notifying them that the time limit for sharing this asset has expired, so sharing links have been removed from the asset. ## Remediate external over-exposure with a loop function When someone shares a file externally in Google Drive and approval is not given, external collaborators who are not in trusted domains are removed. If approval is given, a 60-day grace period will elapse until sending the approval request again. {% hint style="info" %} When an asset exists in a parent folder, collaborator access is removed from all assets in the folder. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to the Google Drive app, and select the **Remediate external over-exposure with a loop function** playbook. 3. Give an action name. 4. Under the **Change user access** event, define the relevant conditions: * The `Get actor email` condition is in a specific group * The `Added collaborators` condition contains at least one domain that is **not** trusted * The `Has added collaborators` condition is true. 5. Add any relevant conditions.

6. Customize the approval request sent to the actor for externally sharing an asset. 7. If the share **isn't** approved or the approval request times out, customize the array filter step for elements that are not in trusted domains. These collaborators are removed. 8. If the share **is** approved: * Customize the Slack message sent to the Security team. * Customize the approval message sent to the actor after 60 days. * Customize the array filter step for elements that are **not** in trusted domains. These collaborators are removed. ## Remove external sharing To mitigate the risk associated with externally sharing a file in Google Drive, you can define automated workflows to remove external collaborators. When someone shares a file externally in Google Drive, the actor is notified by email, and any external collaborators who are not in trusted domains are removed. {% hint style="info" %} When an asset exists in a parent folder, collaborator access is removed from all assets in the folder. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to the Google Drive app, and select the **Remove external sharing** playbook. 3. Give an action name. 4. Under the **Change user access** event, define the relevant conditions: * `Get actor email` = Is in a specific group * `Added collaborators` = `At least one not in trusted domains` * `Has added collaborators` is true 5. Add any relevant conditions.

6. Customize the **Notify by email** message to send to the actor. Let them know that the file will be removed immediately, as the collaborator is outside of the organization's trusted domains, and the sharing violates organizational policy. 7. Customize the **Array filter** action to filter for collaborators who are not in trusted domains. These collaborators will be removed. 8. Customize the **Remove collaborator** action to remove the filtered collaborators who aren't from trusted domains. 9. Specify how to continue the workflow in the case of errors. ## Remove external collaborators and restore after approval If your organization enforces a zero-trust sharing policy, you can automatically remove all external collaborators, and then automatically restore collaborators only after the file sharing is approved. This granular control significantly strengthens your data security posture. When someone shares a Google Drive asset with a private email, the external user permissions are instantly removed from the asset. If the file sharing is approved, for example by the SecOps team or the actor's manager, then the external user permissions are automatically restored, and the actor is notified in Slack that the sharing was approved. {% hint style="info" %} When an asset exists in a parent folder, collaborator access is removed from all assets in the folder. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to the Google Drive app, and select the **Remove external collaborators and restore after approval** playbook. 3. Give an action name. 4. Under the **Change user access** event, define the relevant conditions: `Collaborator has a private email` 5. Add any relevant conditions.

6. The **Remove collaborator** action automatically removes collaborators who have private email domains. 7. Customize the **Approval** step to send an email or Slack message to the SecOps team or actor's manager, asking to approve the file sharing. * **Yes** - External collaborators are automatically restored by the **Add collaborator** step. * **No** or **Timeout** - The workflow ends. 8. Customize the **Notify in Slack** message to send to the actor. Let them know that the file sharing was approved and the external user permissions were restored to the Google assets. ## Remove external collaborators on-demand You can trigger an inventory action to remove external collaborators from Google Drive assets on-demand. {% hint style="success" %} You can customize [inventory actions](/docontrol-user-guide/workflows/inventory-actions-quick-actions.md) to meet your organization's requirements. When you trigger the inventory action, select the relevant workflow you created. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to External sharing, and select the **Remove collaborators on-demand** playbook for Google Drive.

3. Add any actions, such as **Notify by email** or **Notify in Slack**. 4. Save the workflow with a new name. 5. When you trigger the inventory action, select the relevant workflow you created. ## Remove collaborators from a specific domain on-demand You can trigger an on-demand, aggregated inventory action to remove external collaborators, who belong to a specific domain, from Google Drive assets. {% hint style="success" %} You can customize [inventory actions](/docontrol-user-guide/workflows/inventory-actions-quick-actions.md) to meet your organization's requirements. When you trigger the inventory action, select the relevant workflow you created. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to External collaborator sharing for Google Drive, and select the **Remove collaborators from a specific domain** playbook for Google Drive. 3. Give the workflow a name and description.

4. The **Event filter** action is pre-populated to filter for a specific domain name, for example, hotmail.com. 5. Add any relevant conditions. 6. The **Remove collaborator** action is pre-populated to remove all collaborators from the filtered domain name. Define the error handling. ## Remediate external sharing of PII When someone shares a sensitive file externally in Google Drive, the file is scanned for PII labels: * If the probability of containing PII is high, external collaborators who are **not** in trusted domains are removed, and the actor is notified by email. * If the probability of containing PII is medium, an approval request is sent to the actor to approve the external file sharing. If he doesn't approve, external collaborators who are **not** in a trusted domain are removed. * If the probability of containing PII is not medium, 30 days must pass before asking the actor to approve. If the file sharing is **not** approved, any external collaborators who are **not** in trusted domains are removed. {% hint style="info" %} When an asset exists in a parent folder, collaborator access is removed from all assets in the folder. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to the Google Drive app, and select the **Remediate external sharing of PII** playbook. 3. Give an action name. 4. Under the **Change user access** event, define the relevant conditions: * The `Added collaborators` condition contains at least one that's **not** in your trusted domains * The `Has added collaborators` condition is true. 5. Add any relevant conditions. 6. Customize the PII scan to search for specific keywords, such as `bank account number`. 7. In the **Conditional** step, define a **high** probability ratio of containing PII keywords. * If true, collaborators are removed. * Customize an email message sent to the actor.

8. In the next **Conditional** step, define a **medium** probability ratio of containing PII keywords. * If true, customize the approval request sent to the actor. * Customize the array filter step for elements that are **not** in trusted domains. These collaborators are removed. * If false, customize an approval request sent to the actor after 30 days. * If the share **isn't** approved or the approval request times out, customize the array filter step for elements that are not in trusted domains. These collaborators are removed. ## Remediate external sharing of files having sensitive Google labels When someone shares files externally in Google Drive with a sensitive Google label, such as "Restricted," the external collaborators from non-trusted domains are automatically removed from the assets, and the actor is notified in Slack. If the SecOps team approves the file sharing, the external collaborators are not removed. {% hint style="info" %} * This playbook is **event-aggregated**, so external collaborators can be removed from multiple Google assets. * DoControl supports organization-wide labels that are open to all users, not a restricted group of users. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to the **Google Drive** app and **External collaborator sharing** category, and select the **Remove external sharing of files having sensitive Google labels** playbook. 3. Give an action name for the trigger.

This playbook detects and remediates externally shared Google assets with the "Restricted" label

4. Under the **Change user access** event, these conditions are pre-populated: * Collaborators were added * Collaborators are not in trusted domains * Google label is restricted 5. Add any relevant conditions. 6. In the **Approval** step, customize the email or Slack message to send to your SecOps team asking them to approve or reject the external sharing of the sensitive Google files: * **Yes** - If the SecOps team approves, end the workflow. * **No** or **Timeout** - If the SecOps team doesn't approve, customize the **Remove collaborator** step. 7. In the **Remove collaborators** step, customize the error handling. 8. Customize the **Notify in Slack** step to inform the actor that the collaborators will be removed immediately since it's organizational policy not to share sensitive files with external users from non-trusted domains. ## Auto-expire external sharing with private accounts When someone shares with private accounts in Google Drive, the actor is notified by email, and any external collaborators who have private email domains are removed. {% hint style="info" %} When an asset exists in a parent folder, collaborator access is removed from all assets in the folder. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to the Google Drive app, and select the **Auto-expire external sharing with private accounts** playbook. 3. Give an action name. 4. Under the **Change user access** event, define the relevant conditions: * The `Added collaborators` condition contains at least one private email domain from your [keyword list](/docontrol-user-guide/system-management/settings/lexical-lists.md). * The `Get actor email` condition is in a specific group. * The `Has added collaborators` condition is true. 5. Add any relevant conditions.

6. Customize the approval request sent to the actor for externally sharing an asset with a private account. 7. Customize the array filter step for elements that are included in your keyword list of private email domains. These collaborators are removed. ## Remediate external sharing of sensitive content When someone shares an asset that contains sensitive content - data classifiers or regex patterns - externally in Google Drive, the actor is asked to approve the file sharing. If the sharing is not approved, the external collaborators are removed. {% hint style="info" %} When an asset exists in a parent folder, collaborator access is removed from all assets in the folder. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to the Google Drive app, and select the **Remediate external sharing of sensitive content** playbook. 3. Give an action name. 4. Under the **Change user access** event, define the relevant conditions: * Asset type is not video * New collaborators were added 5. Add any relevant conditions. 6. Customize the **Data scan** action to scan for a specific data classifier or regex pattern.

7. If the **Conditional** action that a file contains a high-probability match (above 70%) is **True**: * Customize the **Event filter** step to retrieve all assets with high probability matches (above 70 precent). * Customize the **Approval** step to send a Slack message to the user, asking them to approve sharing a file that contains sensitive content. * If the user **approves** the file sharing: customize the **End workflow** action with the relevant workflow status. * If the user does **not** approve the file sharing: customize the **Remove collaborator** step. 8. If the **Conditional** action that a file contains a high-probability match (above 70%) is **False:** * Customize the **End workflow** action with the relevant workflow status. ## Remediate external sharing of sensitive Regex content When someone shares an asset that contains a sensitive keyword externally in Google Drive, the security team is notified and external collaborators who are not in trusted domains are removed. {% hint style="info" %} When an asset exists in a parent folder, collaborator access is removed from all assets in the folder. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to the Google Drive app, and select the **Remediate external sharing of sensitive Regex content** playbook. 3. Give an action name. 4. Under the **Change user access** event, define the relevant conditions: * The `Has added collaborators` condition is true. * The `Added collaborators` condition contains at least one domain that is **not** trusted. * The `Get mime type` condition is a file type format that supports regex scanning. 5. Add any relevant conditions. 6. Customize the **regex scan** action to scan for a specific lexical list or patterns.

7. If the **Conditional** action that a file contains a sensitive keyword is **True**: * Customize the Slack message sent to the Security team. * Customize the **Array filter** that extracts elements not in trusted domains, and remove collaborators from those domains. 8. If the **Conditional** action that a file contains a sensitive keyword is **False:** * Customize the **End workflow** action with the relevant workflow status. ## Remediate external sharing if user has active alerts When someone shares files with external collaborators in Google Drive, check if the actor has any active alerts. If yes, remove external sharing permissions until the alerts are handled. {% hint style="info" %} When an asset exists in a parent folder, collaborator access is removed from all assets in the folder. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to the Google Drive app, and select the **Remediate external sharing if user has active alerts** playbook. 3. Give an action name. 4. Under the **Change user access** event, define the relevant conditions: * The `Has added collaborators` condition is true. * The `Added collaborators` condition contains at least one domain that is not in your organization's list of trusted domains. * The `Get actor email` condition equals a specific user. 5. Add any relevant conditions.

6. Customize the **DoControl API** step to retrieve alerts for the specific user. 7. Customize the **Conditional** step: does the user have active alerts? * True - Customize the **Remove collaborator** step to remove external sharing permissions until alerts are handled. Customize the error handling step. * False - End workflow ## Notify when non-admin users move files outside the organization When a non-admin user moves Google files to an external organization by changing the owner to an external user, the SecOps team is notified in Slack. 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to the **External collaborator sharing** and **Google Drive** categories, and select the **Notify when non-admin users move files outside the organization** playbook. 3. Give the workflow a description.

4. The **Change owner** trigger is automatically populated with the condition that the target is not from a trusted domain. 5. Add any relevant conditions. 6. The **DoControl AP**I step automatically retrieves user info from Google Workspace. 7. The **Conditional** step is already pre-populated with these conditions: * The user is a Google admin, OR * The user is a delegated Google admin 8. If the user is a Google admin: * **True** - The workflow ends with a success status. * **False** - Customize the **Notify in Slack** action to send a message to the SecOps team:\ Hi SecOps, A non-admin user assigned owner permissions to an external user, and in effect moved files to an external organization. Non-admin user: `` External organization's email: `` Exfiltrated files: `` \ Please make sure to instruct the user on company guidelines. If necessary, ask the user to revert and remove the external owner permissions. Thanks, DoControl team ## Remove internal and external collaborators on-demand You can trigger an inventory action to remove all internal and external collaborators from My Drive assets on-demand. When assets are shared with users from your organization, there's a risk of breaching "ethical walls" between departments. Sharing assets with users outside your organization increases the risk of data exfiltration. After removing both internal and external access permissions, asset owners still have access to their assets. {% hint style="success" %} You can customize [inventory actions ](/docontrol-user-guide/workflows/inventory-actions-quick-actions.md)to meet your organization's requirements. When you trigger the inventory action, select the relevant workflow you created. {% endhint %} 1. In Workflows, select **Playbooks**. 2. Filter the playbooks according to External collaborator sharing, and select the **Remove internal and external collaborators on-demand** playbook for Google Drive.

3. Save the workflow with a new name. 4. Customize the **Remove collaborator** action, especially the error handling. 5. When you trigger the inventory action, select the relevant workflow you created. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/external-collaborator-sharing/google-drive-playbooks-for-external-sharing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.