How to Stop Sensitive Files Being Shared Externally From Google Drive and SharePoint

To stop sensitive files being shared outside the company, set who can receive them and use content rules to restrict what can leave. In Google Drive, combine sharing settings, trust rules, and DLP for Drive. In SharePoint and OneDrive, combine sharing settings with Microsoft Purview DLP. Test approved partner exchanges alongside unwanted shares before changing enforcement.

How to Restrict Risky External Sharing in 6 Steps

Restrict risky sharing by defining approved recipients, checking existing access, testing content rules, and validating the action for each path. Keep legitimate partner exchanges in the test set. A useful result is that protected files can't reach unapproved recipients while the business can still share the content it's approved.

1. List the trusted partners and the teams that share with them

Write down the partner domains, named recipients, and internal teams that need to collaborate. Record which content they're allowed to exchange. Use those cases to configure supported sharing scopes and test the result; an approved partner doesn't need access to every sensitive file.

2. Set the native baseline

Decide where public links are acceptable and who can create them. Set external sharing by organizational unit or site. In Google Workspace, use sharing settings and trust rules. In Microsoft 365, use organization and site sharing levels and domain lists, with Anyone links reviewed separately.

Check what you've already shared as well as new sharing. Review public links and broad permissions on sensitive files, correct inappropriate access in the source platform, and verify the result from an external test account. Test a new sharing attempt separately; one successful test doesn't establish the state of every existing link.

3. Run content rules in audit or simulation mode first

Google supports audit-only rules and Microsoft supports simulation mode. Use the supported test mode to review representative sharing activity with the data owner. Check approved partner exchanges and unwanted transfers, then adjust the rule before enabling its enforcement action. Audit and simulation results don't themselves block sharing.

4. Check what your controls can explain

For each test share, inspect the content, file source, sender, recipient, access scope, and business purpose. Start with the controls and logs you already have. Where evidence is missing, evaluate whether a supported integration can supply it and show the related activity across platforms.

5. Apply the right action for each sharing path

After testing, enable the supported blocking action for content that mustn't reach external recipients. Use warnings or user overrides only where the selected feature supports them and the policy permits an exception. Verify the result from the recipient's side. Keep existing required controls active while validating any added layer.

6. Review exceptions on a schedule

Every approved partner, exception, and override should have an owner and a review date, or it'll outlive the reason it was approved. Sharing needs change when deals close, vendors change, and projects end.

What Google Drive and SharePoint DLP Covers

Google Drive and SharePoint DLP combines sharing settings with rules that detect sensitive content and apply supported actions. Sharing settings define eligible recipients; content rules determine which files need protection. Monitoring supplies evidence about observed activity. The result depends on the configured scope, available controls, and whether enforcement has been enabled.

Use the layers together. Sharing settings define who can receive files, and DLP rules add content-based conditions and actions. Monitoring gives reviewers evidence about what happened. Test whether your configured controls and logs explain a share well enough to distinguish an approved partner exchange from exposure.

How Google Workspace DLP Works for Drive

Google Workspace DLP lets admins create data protection rules that scan content and block, warn, or audit when users share it. For Drive, a rule combines conditions, such as predefined data types or custom detectors, with an action. Rules apply to My Drive and shared drives, and availability depends on the Google Workspace edition.

Google's DLP overview lists the apps it covers: Drive files, Gmail messages, Google Chat messages, Calendar events, and Chrome browser activity through DLP for Chrome, plus controls for Gemini. For Drive, the DLP for Drive documentation describes:

• Conditions: predefined data types, text strings, regular expressions, word lists, custom content detectors, and classification labels, combined with AND, OR, and NOT.
• Actions: block external sharing, warn the user (who can cancel or share anyway), disable download, print, and copy, apply a classification label, or audit only. If rules conflict, the stricter action applies.
• Editions: DLP for Drive is listed for Enterprise Standard and Enterprise Plus, Frontline Standard and Plus, Education Fundamentals, Standard, and Plus, and Enterprise Essentials Plus.
• Scanning: Google scans eligible files whenever a rule is added or changed, and that scan can take a few hours, a day, or longer.

Google's rule-creation guide recommends starting with an audit-only rule, which records matches without taking action, and switching it to an action once the results look right.

How to Stop External Sharing in Google Drive

Restrict external sharing in Google Drive with three tools used together: sharing settings by organizational unit or group, trust rules that set who can share with whom, and DLP rules that act on content. In September 2026, Google added sharing boundaries that combine audience and sensitivity in one rule.

Sharing settings. Admins can turn external sharing off, allow it only with trusted domains, and show an External warning on files shared outside the organization. Google's documentation on managing external sharing says group settings override organizational units, and changes can take up to 24 hours to take effect.

Trust rules. Trust rules set finer boundaries, such as letting one team share with named users at a partner while blocking other teams from sharing with that partner. They're supported only in certain editions, including Enterprise Standard and Enterprise Plus.

Sharing boundaries. Google's September 15, 2026 announcement lets one rule block sharing with all external users, allow sharing only with named groups or domains, or block specific ones, for files that match a classification label or DLP condition. The announcement lists supported editions and a gradual rollout.

How SharePoint and OneDrive DLP Works

SharePoint and OneDrive control external sharing at two levels, the organization and each site, and Microsoft's documentation says the most restrictive setting applies when they differ. Microsoft Purview DLP adds content-based policies that can block people outside the organization from accessing items that contain sensitive information or carry a sensitivity label.

Sharing levels. Microsoft notes that external sharing is turned on by default for the whole SharePoint and OneDrive environment. The organization-level setting decides whether any site can share outside the organization, individual sites can be stricter, and OneDrive settings can match or be stricter than SharePoint's.

Anyone links and domain lists. Microsoft's guidance on limiting accidental exposure describes turning off Anyone links for the organization or a site, and using domain allow and deny lists. The same page says domain lists affect only sharing with guests, so a blocked domain can still receive an Anyone link unless those links are turned off. It also recommends leaving Anyone links on for appropriate content, because turning them off can push people toward tools IT doesn't control.

Purview DLP policies. Microsoft's external sharing walkthrough builds a policy that blocks people outside the organization from accessing items containing sensitive information types, such as Social Security numbers or card numbers, or a chosen sensitivity label. It sends alerts to the security team, shows the user a policy tip, and runs in simulation mode first. A preview variant blocks only specific external domains or users.

Limits of Google Drive and SharePoint DLP

Native controls govern their own platform, and each vendor's documentation describes the boundaries. Plan around scan timing, content that isn't scanned, edition and licensing requirements, and separate admin models for companies on both platforms. Then test which parts of a file's history and sharing context your configuration can explain.

• Timing. Google says rescanning after a rule change can take hours or longer, and settings changes can take up to 24 hours.
• Content types. Google doesn't scan comments, password-protected files, or video and audio files, and scans images inside PDFs only when optical character recognition is on.
• Link types. Microsoft's domain allow and deny lists apply only to guest sharing, so a link that needs no sign-in sits outside them.
• Editions and licenses. Trust rules, sharing boundaries, and DLP for Drive depend on the Google Workspace edition. Purview features depend on Microsoft 365 licensing.
• Two consoles. A company on both platforms writes and tunes rules twice, in two admin models, with two sets of alerts.
• Context. Google's trust rules can scope sharing by users, groups, organizational units, and domains, including partner relationships. Test whether your configured controls also show the file's origin and prior movement, and whether the available context is enough to explain a particular share.

None of this is a reason to skip the native controls. They're the right baseline, and many sit inside licenses you may already own, depending on edition. You'll want to know exactly what they leave open before deciding what to add.

How to Tell Partner Collaboration From Exposure

To distinguish partner collaboration from exposure, check the content, source, sender, recipient, access scope, and expected business use. A familiar domain alone doesn't settle the question. Use the combined evidence to decide whether a share should proceed, needs investigation, or should be stopped.

Use a sales-approved deck you'd send to a prospect and a customer contract you wouldn't send to a personal address as a proof-of-concept pair. Keep the file type and sharing setting the same, then check which differences your controls recognize: content, sender, recipient, and file history. Inspect the reason for each result before deciding where you'd need extra context.

How ORION Security Monitors Drive and SharePoint Sharing

ORION Security treats external sharing as a data movement question as well as a permissions question. It connects to Google Drive, OneDrive, and SharePoint through APIs and judges each observed share on what was shared, where it came from, who shared it, who received it, and whether that fits the business.

The detection model evaluates three forms of context together: lineage, which explains where the file came from and how it moved; classification, which determines what it contains; and identity and environment, which assess whether the share makes sense for that user, role, account, and destination. Compare a contract downloaded from the CRM and sent to a personal account with an approved sales deck sent to a named partner. Check which parts of each sequence your deployment observes, and inspect the explanation for each result.

Controls depend on the surface. Confirm which connected workflows support real-time warnings or blocking, which support investigation or post-event remediation, and which actions your team must take in the source platform. Test each path before you rely on it. ORION Security works alongside Google's and Microsoft's own controls, adding source and behavioral context to the shares those controls permit. Useful findings can arrive before a full policy library exists, and policies remain available for deterministic requirements and exceptions.

ORION Security reports roughly five percent false positives in its production customer materials. The Policy Effectiveness dashboard shows observed coverage, false-positive performance, and expected daily impact, so the security team has evidence to decide when a path is ready for stronger enforcement.

Interested in ORION Security? Learn more.

Frequently Asked Questions

Does Google Workspace have DLP?

Yes. Google Workspace includes DLP rules for Drive, Gmail, Chat, and Calendar, plus DLP for Chrome and controls for Gemini, depending on edition. A Drive rule can block external sharing, warn the user, restrict download, print, and copy, or audit only.

Is DLP for Drive available in every Google Workspace edition?

No. Google lists DLP for Drive for Enterprise Standard and Enterprise Plus, Frontline Standard and Plus, Education Fundamentals, Standard, and Plus, and Enterprise Essentials Plus. Check your edition before you plan rules around it, because it's easy to design a rule you can't run.

Does Microsoft Purview DLP cover OneDrive as well as SharePoint?

Yes. Purview DLP policies can target SharePoint sites and OneDrive accounts, and Microsoft's walkthrough blocks people outside the organization from accessing items that match. OneDrive sharing settings can also be stricter than SharePoint's.

Should we turn off Anyone links in SharePoint?

It depends on how your company works, and there isn't one right answer. Microsoft describes how to turn them off for an organization or a site, and also recommends leaving them on for appropriate content so people don't turn to tools outside IT's control. If you turn them off, domain allow and deny lists become more effective.

How long does Google DLP take to scan existing files?

Google says DLP for Drive tries to scan all eligible files whenever a rule is added or modified, and that scan can take a few hours, a day, or longer. Plan for that gap before you assume a new rule covers files that already exist.

Can DLP tell a partner from a personal account?

Start by defining trusted partner domains, groups, and recipients in the controls you use. Then test an approved partner share and a share to a personal account, checking both the result and its explanation. Confirm which account and destination signals the platform uses in your deployment.