Google Workspace Admins can now monitor Drive files changed by external users

The Google Workspace Updates blog has announced that starting March 2nd, Admins will now be able to see events in their Google Drive logs that involve their organization and other external organizations or users.

This change will allow Admins to monitor when files that are shared with users that are not in their organization, are being copied, moved, or changed outside their domain. Access to these logs will also aid them with more efficiently controlling – and possibly avoiding – data exfiltration. Admins may check their Drive audit log by doing the following:

1. Sign in as an administrator to the Google Admin console

2. From the Admin console Home page, go to Reports

3. On the left, click Audit > Drive

Google Workspace Admin Help

This will be a gradual rollout for Rapid and Scheduled Release domains with up to 15 days for full feature visibility. No direct action will be required by the Admins as the feature will be turned on by default and the events will appear in the logs automatically.