> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/inventory/inventory-users/google-workspace-users/external-users.md).

# External users

External users are users outside your organization with access to company assets. External users can be your employees, who are accessing assets with their personal emails.

If you leverage the Identities module, you can filter external users according to their identity data. External users with a related identity are actually **current or former** **company employees who are sharing assets with their personal emails**. 

{% hint style="success" %}
To use the Identities module, you need to integrate DoControl with an HRIS or Okta.
{% endhint %}

After you filter a specific user's assets, you can generate a [CSV report](#generate-csv-report) or [remediate exposure ](#remediate-asset-exposure)for specific assets. 

The external users page displays the following data:

* [External user list](#external-user-list)
* [External user details](#external-user-details)
* [Assets](#assets)
* [Events](#events)

{% hint style="success" %}

* You can remove external permissions from **all** your Google Drive assets for selected external users [in bulk](#remove-external-user-permissions), for up to a maximum of 100,000 permissions.
* If you apply Identity filters and wish to remediate your external users, you need to multi-select the external users page by page. Currently, multi-select across pages is not supported.
  {% endhint %}

## Locate an external user

To view personal details, asset and event data for a specific external user in Google Workspace:

1. From the DoControl side menu, click **Inventory** > **Users**.
2. Select **Google Workspace** and **External**.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FverzhubT2MWHdNbC3PRF%2FGoogle%20users%20choose.png?alt=media&amp;token=768df7d6-b619-416d-8fe1-0fbcdb53accc" alt=""><figcaption></figcaption></figure>
3. Enter a user's **external email address**, or enter the user's **identity name**.
4. Click **Filters** to filter for specific external users.

## Filter external users

Filter options for external users in Google Workspace include the following:

* **External user** - Retrieve domain and group data
* **Identity** - Retrieve identity data for all external users linked to employees. You can leverage these filters with the Identities module, by integrating DoControl with an HRIS or Okta.

<table><thead><tr><th width="214.953125">Filter</th><th width="169.15234375">Comparator</th><th>Description</th></tr></thead><tbody><tr><td><strong>External user</strong></td><td></td><td></td></tr><tr><td>External domain</td><td>Equals, doesn't equal, starts with, ends with, contains, doesn't contain, includes, excludes</td><td>Domains with external users who have access to assets in your organization</td></tr><tr><td>External user in group</td><td>Includes or excludes</td><td>Organizational <a href="/docontrol-user-guide/saas-data-monitoring/inventory/settings-groups.md">group</a> to which an external user belongs</td></tr><tr><td><strong>Identity</strong></td><td></td><td></td></tr><tr><td>Admin</td><td>True or false</td><td>If external user is an admin or not</td></tr><tr><td>Employment status</td><td>Includes or excludes</td><td><p>Select user's employment status based on HRIS or Okta data:<br></p><ul><li>Active </li><li>Terminated </li><li>About-to-leave </li></ul></td></tr><tr><td>Employment type</td><td>Equals, doesn't equal, starts with, ends with, contains, doesn't contain, includes, excludes</td><td><p>Name of employment position, such as:<br></p><ul><li>Full-time</li><li>Contractor</li><li>Half-time</li><li>Temporary</li></ul></td></tr><tr><td>Has identity</td><td>True</td><td>If external user has a related identity </td></tr><tr><td>Job title</td><td>Equals, doesn't equal, starts with, ends with, contains, doesn't contain</td><td>Enter string for user's role</td></tr><tr><td>Last activity</td><td>Equals, after, before, is between</td><td>Date of most recent event triggered by a user or app acting in a user’s name</td></tr><tr><td>Risk score</td><td>is between</td><td><p>Select risk score bracket:<br></p><ul><li>Critical: 80-100</li><li>High: 50-79</li><li>Medium: 30-49</li><li>Low: 0-29</li></ul></td></tr><tr><td>VIP</td><td>True or false</td><td>If external user is a VIP (director, vice president)  or not</td></tr><tr><td>Watchlist</td><td>True or false</td><td>If external user is in watchlist or not</td></tr></tbody></table>

## External user list

If your external users in Google Workspace have a related identity, you can view all their identity data. If an external user has an identity, it indicates that an employee is sharing company assets with their personal email (as retrieved from HRIS).

{% hint style="success" %}

* You can [remediate](#remediate-asset-exposure) asset sharing with external users by removing permissions from all selected users
* The external user list is updated **every hour**. After remediating external user permissions, it takes up to 1 hour to view the updated external user list.
* To view identity data, you need to leverage the Identities module by integrating DoControl with an HRIS or Okta.
  {% endhint %}

You can sort the external user list according to:

* **Email** - Display external users in alphabetical order
* **Asset count -** Display external users according to the highest number of accessed assets

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FnAH4l8XBzZrBchqoeRgw%2Fexternal%20users%20GM.png?alt=media&amp;token=4fdf4331-f64f-427e-9314-e407e68be903" alt=""><figcaption></figcaption></figure>

All external users in your Google Workspace are displayed with these parameters:

<table><thead><tr><th width="223.87890625">External user parameter</th><th>Description</th></tr></thead><tbody><tr><td>Email</td><td>External user's email address. Click the email to open the <a href="#external-user-details">external user details</a> with <a href="#assets">asset</a> and event data. </td></tr><tr><td>Related identity</td><td>Name of external user's identity. This indicates that an employee is sharing company assets with their personal email (retrieved from your HRIS).</td></tr><tr><td>Watchlist <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FVjm2e9IrAizSn4HreEzL%2Fwatchlist%20icon.png?alt=media&amp;token=fee8ac03-22f8-49e9-9759-75d0bd924a52" alt="" data-size="line"></td><td>Indicator if identity is being monitored in watchlist or not</td></tr><tr><td>User status</td><td>Google Workspace status: Active, Suspended, Archived, or Deleted</td></tr><tr><td>Risk score</td><td>Total risk score for the user. The arrow indicates the increase or decrease compared to the last 30 days</td></tr><tr><td>View risk breakdown</td><td>Click <strong>View</strong> <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fh1PTUvilwUjBiALm9QC4%2FView%20more.png?alt=media&amp;token=6d06e2fb-9714-4d18-b1e3-2530f04231ce" alt=""> to understand the <a href="/docontrol-user-guide/risk-management/identities/identity-card/user-risk.md#risk-elements">risk elements</a> contributing to the total risk score<br><br><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FE2FLBFWH122juSaD8fqI%2Frisk%20breakdown.png?alt=media&amp;token=442ded41-cef2-41fe-a589-26f1b77e7be7" alt=""><br><br>Click <strong>View identity</strong> to open this user in the Identities module.</td></tr><tr><td>Asset count</td><td>Number of Google company assets the external user has access to. Click the number to open the <a href="/docontrol-user-guide/saas-data-monitoring/inventory/inventory-assets/google-drive-assets.md#all-assets">Assets</a> page filtered with the user as an external collaborator.</td></tr><tr><td>Remediate</td><td>Click <a href="#remove-external-user-permissions">Remediate</a> to remove the user's permissions from all Google assets</td></tr></tbody></table>

{% hint style="success" %}
Click **Export to CSV** <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FPWdaV30qx1aefHNdGX9C%2Fdownload%20icon.png?alt=media&amp;token=16257bf4-2b68-4417-91e6-78c5db741fdc" alt="" data-size="line"> to download a consolidated report of external Google Workspace users in CSV format.
{% endhint %}

### Remove external user permissions

You can remove selected user permissions outside your company domain from **all** Google Drive assets. Internal collaborators and asset owners will still have access.

To expedite the remediation process, you can remove **users in bulk** from your organization's Google asset repository, up to a maximum of 100,000 permissions.

{% hint style="warning" %}
If you apply Identity filters and wish to remediate your external users, you need to multi-select the external users page by page, and then remediate. Currently, multi-select across pages is not supported.
{% endhint %}

1. Navigate to **Inventory > Users** > **Google Workspace > External**.
2. Filter and select the external users for removing access.
3. Click **Remove permissions.**

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FZxUC6vPL8NVxNosXayfc%2Fremove%20external%20users.png?alt=media&amp;token=82bf9371-b2a3-423a-91a4-8f06b6ebc816" alt=""><figcaption></figcaption></figure>
4. If the filtered results span several pages, multi-select all external users on each page.
5. If you want to run an assessment report first to see how many assets will be remediated, select [Assess and remediate](https://docs.docontrol.io/docontrol-user-guide/workflows/bulk-remediation/apply-a-bulk-action/assess-and-remediate). Otherwise, select **Just remediate.**

   <div align="left"><figure><img src="https://docs.docontrol.io/~gitbook/image?url=https%3A%2F%2F3236294211-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MesrnyDMZGYg1V-tOBo%252Fuploads%252F3hhnqNS4PJ0mZ9rURyIG%252FBulk%2520remediate%2520external%2520users.png%3Falt%3Dmedia%26token%3D1aec0dba-8f48-4b6d-99d7-d43f94e2e49d&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=d6f5c7e&#x26;sv=2" alt=""><figcaption></figcaption></figure></div>
6. Select the relevant workflow. If you don't have one, [create a workflow ](https://docs.docontrol.io/docontrol-user-guide/workflows/create-a-workflow)based on the relevant playbook.
7. Click **Remediate**. DoControl removes the selected external users from **all** your organization's assets.

{% hint style="success" %}

* After remediating external user permissions, it takes up to 1 hour to view the updated external user list.
* If you wish to remove external users from a **select group of assets**, go to your Google asset inventory and filter according to `External collaborator` and relevant asset parameters.
  {% endhint %}

## External user details

Metadata for a specific external user is displayed as follows:

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FPo9bUz5jI1uK5FVrbJNQ%2Fexternal%20user%20details%20Google.png?alt=media&amp;token=ddf5d6b8-6a8d-494f-a45e-960e5a83408e" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To view identity data, you need to enable the Identities module by integrating DoControl with an HRIS or Okta.
{% endhint %}

<table><thead><tr><th width="271">External user detail</th><th>Description</th></tr></thead><tbody><tr><td><strong>User details</strong></td><td></td></tr><tr><td>Email </td><td>Email of external user</td></tr><tr><td>User type</td><td>External</td></tr><tr><td><strong>Identity</strong></td><td>Name of external user's identity. This indicates that an employee is sharing company assets with their personal email (retrieved from your HRIS).</td></tr><tr><td>Watchlist <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FVjm2e9IrAizSn4HreEzL%2Fwatchlist%20icon.png?alt=media&amp;token=fee8ac03-22f8-49e9-9759-75d0bd924a52" alt="" data-size="line"></td><td>Indicator if identity is being monitored in watchlist or not</td></tr><tr><td>Risk score</td><td>Total risk score for the user. The arrow indicates the increase or decrease compared to the last 30 days</td></tr><tr><td>User status</td><td>Google Workspace status: Active, Suspended, Archived, or Deleted</td></tr><tr><td>Department</td><td>Organizational department to which the user belongs</td></tr><tr><td>View identity</td><td>Click <strong>View identity</strong> to open this user in the Identities module</td></tr><tr><td>Risk breakdown</td><td><p>The <a href="/docontrol-user-guide/risk-management/identities/identity-card/user-risk.md#risk-elements">risk elements</a> contributing to the user's total risk score:<br></p><ul><li><strong>Exposure level</strong> - Number of Google assets exposed publicly or externally</li><li><strong>DLP exposure</strong> - Number of Google assets exposed with highly sensitive names</li><li><strong>VIP</strong> - An indication whether this user is a VIP, with the specific VIP role</li><li><strong>Admin roles</strong> - Number of Google admin roles this user has</li><li><strong>Latest alerts</strong> - Number of all active or archived alerts triggered by this user in the last 30 days</li><li><strong>Latest workflows</strong> - Number of workflows triggered by this user in the last 30 days</li><li><strong>Risky shadow apps</strong> - Number of risky shadow apps currently installed by this user</li><li><strong>Employment type</strong> - User's employment type as updated in Okta or HRIS, such as full-time</li></ul></td></tr><tr><td>Remediate</td><td><p>Click <strong>Remediate</strong> to:<br></p><ul><li><a href="/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions.md#remove-permissions">Remove this user's permissions</a> from all Google assets</li><li>View your current <a href="/docontrol-user-guide/workflows/bulk-remediation/apply-a-bulk-action/view-remediations-and-assessments.md">remediation activity and history</a></li></ul></td></tr><tr><td>Related active alerts</td><td>Number of active alerts of the same alert type where this user is the actor or target. Click <strong>View</strong> <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fh1PTUvilwUjBiALm9QC4%2FView%20more.png?alt=media&amp;token=6d06e2fb-9714-4d18-b1e3-2530f04231ce" alt=""> to open the Alerts page filtered for this user's alerts.</td></tr></tbody></table>

## Assets

View and filter metadata for Google assets that can be accessed by an external user.

1. From the DoControl side menu, click **Inventory** > **Users**.
2. Select **Google Workspace** and **External**.
3. Filter for a specific user.
4. Click the user's **email address** to open the external user details.
5. Scroll down to view metadata for all Google Drive assets that this external user can access.

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F3hSOQ9Va7NcUnZAwohoy%2FGoogle%20external%20assets.png?alt=media&amp;token=aefa0666-c2af-47e1-afff-42e10479c6c5" alt=""><figcaption><p>Asset details for a specific external user</p></figcaption></figure>

The metadata displayed for Google assets that can be accessed by an external user includes these parameters:

<table><thead><tr><th width="204.33333333333331">Asset parameter</th><th>Description</th></tr></thead><tbody><tr><td>Asset name</td><td>Name of file in Google Drive. Click to open the individual asset page.</td></tr><tr><td>Sensitivity</td><td>DoControl proprietary sensitivity ranking, based on the asset name</td></tr><tr><td>Drive type</td><td>Location of asset: My Drive or shared drive</td></tr><tr><td>Drive name</td><td>Shared drive name or My Drive owner</td></tr><tr><td>Sharing status</td><td><p>Google statuses indicate how the asset is shared, with the number of collaborators per sharing status:</p><ul><li><strong>Public</strong> - Anyone with the link can access the asset, without authentication.</li><li><strong>External</strong> - Specific external users can access the asset. </li><li><strong>Internal with link</strong> - Anyone with the link can access the asset after authentication.</li><li><strong>Searchable</strong> - Internal users can search for the asset within the organization.</li><li><strong>Internal</strong> - Only specific internal users can access the asset. </li></ul><p><strong>Tip</strong>: Hover over the external sharing status to display the emails of all external users with access to that asset.</p></td></tr><tr><td>Google label</td><td><p></p><p>Google asset categories:</p><ul><li><p><strong>Badged label</strong> - Indicates your organization’s most critical metadata, and is displayed in color next to the asset name. </p><p>Organizations can have one badge with several values. For example, a File Sensitivity badge can have these values: Top Secret, Internal, Public, and Private, each with a different color.</p></li><li><strong>Standard labels</strong> - Tags that indicate file metadata in the file details. Labels can be structured elements including fields and values.</li></ul></td></tr><tr><td>Created on</td><td>Date when the owner created the asset.</td></tr><tr><td>Modified on</td><td>Date when the asset was last updated. Hover to see the actor who last updated the asset.</td></tr><tr><td>Last viewed</td><td><ul><li>Date when the asset was last viewed. </li><li>See historic views from the last 6 months prior to integrating Google Workspace with DoControl.</li><li>Hover to see the actor who last viewed the asset.</li></ul></td></tr><tr><td>Remediate</td><td>Click the magic wand <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FxxTrAqT5s1Zz9cYEJNrn%2Fmagic%20wand%20icon.png?alt=media&amp;token=94994886-2fe3-4e21-8667-0d4ab6f2fae1" alt="" data-size="line"> to remediate a specific asset with the <a href="/docontrol-user-guide/saas-data-monitoring/inventory/inventory-assets/google-drive-assets/google-asset-details.md#to-remediate-external-collaborators">Remove external collaborators</a> inventory action.</td></tr></tbody></table>

{% hint style="success" %}
To see the filtering options for Google Drive assets, see [Filter all assets.](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-assets/google-drive-assets.md#filter-all-assets)
{% endhint %}

### Generate CSV report

You can generate a report for selected asset metadata in CSV format.

1. Select the relevant assets.
2. Click the **Export to CSV** <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FPWdaV30qx1aefHNdGX9C%2Fdownload%20icon.png?alt=media&amp;token=16257bf4-2b68-4417-91e6-78c5db741fdc" alt="" data-size="line"> icon.
3. Name your report and select the columns you wish to include in your report.<br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FVgrYinFvVTGjbLHKxJ9n%2Fexport%20to%20CSV%20report.png?alt=media&amp;token=cfd09ade-6df1-4a01-98c3-e92d2c6a46f2" alt="" width="563"><figcaption></figcaption></figure></div>
4. Click **Create report**.&#x20;

{% hint style="info" %}
It might take a few minutes or more to download your report.&#x20;

The maximum report download size is 1 GB.

You can export up to 1 million assets per report.
{% endhint %}

### Remediate asset exposure

You can apply [inventory actions](/docontrol-user-guide/workflows/inventory-actions-quick-actions.md) to selected assets, in order to manually trigger on-demand remediation actions to resolve specific issues. These inventory actions are available:

* [Remove external collaborators](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions.md#remove-external-collaborators)

## Events

DoControl monitors real-time events of user activities in Google Drive. If no date range is selected, events are displayed from the last 30 days.

#### To view events for a specific external user:

1. From the DoControl side menu, click **Inventory** > **Users**.
2. Select **Google Workspace** and **External**.
3. Filter for a specific user.
4. Click the user's **email address** to open the external user details.
5. Scroll down to view metadata for the user's events in Google Drive.

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FzcF3Iv9TMZyCKm1JKn2P%2Fexternal%20user%20events%20Google.png?alt=media&amp;token=52733033-8f9f-403a-8399-98de6a0c7932" alt=""><figcaption><p>Event details for a specific external user in Google Drive</p></figcaption></figure>

The metadata displayed for a user's events in Google Drive includes these parameters:

<table><thead><tr><th width="271">Event parameter</th><th>Description</th></tr></thead><tbody><tr><td>Date and time</td><td>When the event occurred</td></tr><tr><td>Actor </td><td>The user who triggered the event</td></tr><tr><td>Target</td><td>Recipient of the event. If the recipient is a Google email alias, the user's real email address is displayed.</td></tr><tr><td>App</td><td>App involved in the event: Google Drive</td></tr><tr><td>Asset</td><td>Name of the asset involved</td></tr><tr><td>Event type</td><td>Type of event as defined in Google Drive (View, Edit, etc)</td></tr><tr><td>Triggered</td><td>Number of workflows or alerts that were triggered by this event</td></tr><tr><td>Event ID</td><td>Unique identifier for the event</td></tr><tr><td>Event JSON</td><td>Click to open the JSON file with raw details about the event</td></tr></tbody></table>

{% hint style="success" %}
Click **Export to CSV** <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FPWdaV30qx1aefHNdGX9C%2Fdownload%20icon.png?alt=media&amp;token=16257bf4-2b68-4417-91e6-78c5db741fdc" alt="" data-size="line"> to download a consolidated report of event metadata for a specific Google Workspace user.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/inventory/inventory-users/google-workspace-users/external-users.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.