Drive Management: getting started (via CloudM Labs)

Updated August 11, 2026 10:19

What Drive Management does

Drive Management gives administrators a single place in Automate to see and manage the shared drives across their domain, browse the files inside them, and view an individual user's My Drive, without leaving Automate or signing in as the user.

It covers three areas:

Shared Drives: an inventory of every shared drive in your domain, with settings, membership and drive-level actions.
Files: browse and act on the files inside a shared drive.
Users' My Drive: view an individual user's Drive content from their record in Directory.

Before you start

There are three steps. CloudM does the first, and you do the other two.

Step 1: CloudM Labs

A request needs to be submitted via CloudM Labs, which will need approving by CloudM. The this will allow you to switch on Settings > CloudM Labs > Drive Management for your domain.

You will also need administrator access, as Drive Management is only available to administrators.

Step 2: Configure a domain-wide delegation service account

Drive Management uses a service account from your own Google Cloud project rather than the default shared one. This gives it access to scopes that cannot be added to the default setup, and keeps the Drive API work for your domain in your own project.

Go to Settings > Domain Settings > Domain Wide Delegation.
Upload your service account.
Run validation with the Drive Management option selected.

In the Google Admin console, the service account's client ID needs both of these scopes delegated to it:

https://www.googleapis.com/auth/drive,
https://www.googleapis.com/auth/cloud-identity.orgunits

The Cloud Identity API also needs to be enabled in the Google Cloud project that hosts the service account.

Both scopes are required, and there is no fallback. The cloud-identity.orgunits scope is what allows a shared drive to be created or moved between organisational units. If it is missing, those two actions fail straight away rather than falling back to the default service account.

Credentials are cached, so after changing the service account or its scopes, allow a few minutes before testing.

Step 3: Turn on shared drive sync

Drive Management works from a synchronised inventory of your shared drives, so sync needs enabling before the list will populate.

Go to Settings > Domain Settings > Domain Actions.
Enable Automatic Shared Drive Sync.

Waiting for the first sync

Shared drives are synchronised as part of your existing domain sync, under Settings > Domain Settings > Domain synchronisation, alongside users, groups and organisational units. Sync collects shared drive information such as name, organisational unit, and members and permissions.

Until the first sync completes, the Shared Drives list will be empty or incomplete.

There are two independent syncs:

Sync	How often	What it updates
Domain Sync	Roughly every 48 hours	Users, groups, organisational units, and basic shared drive information such as name and image.
Per-Drive Details Sync	Roughly every 5 days per drive	Members, file count and public link count for that drive.

When Domain Sync finds a new drive, its first details sync is normally picked up within about 20 minutes.

Manual Sync starts the Per-Drive Details Sync for one drive without waiting for its next scheduled run. A small drive usually finishes within seconds; larger drives, or busy periods when many drives are syncing, can take longer. With Automatic Shared Drive Sync enabled your basic drive information and membership should already be current, so Manual Sync is mainly useful for refreshing file and public link counts sooner.

Three things that sound similar but do different jobs:

Refresh asks for the latest data already stored in CloudM. It does not contact Google Workspace.

Sync pulls data from Google Workspace into CloudM. It does not send CloudM data to Google.

Actions, such as creating, renaming or updating a drive, are sent straight from CloudM to Google Workspace as separate operations.

Opening Drive Management

Once the module has been enabled, a Drive Management group appears in the Automate sidebar, containing Shared Drives.

Finding your way around the drive list

The Shared Drives page lists every shared drive in your domain.

Search by shared drive name.
Filter by organisational unit and sync status, with More filters for members, managers and permissions.
Sort by drive name, members, managers, files or size, and choose 10, 20 or 50 results per page.
Choose your columns: managers, members, organisational unit, file count, public links, size, sync status and created date. The drive name is always shown.

A good first place to look after your initial sync is the drives nobody is managing. Shared drives with no manager are flagged, and you can see just those using More filters > Managers > Unmanaged.

Viewing and managing a drive

Selecting any column after the drive name opens a summary page for that drive, with three tabs:

Overview, the drive's details.
Security & policies, showing the organisational unit and the access settings for the drive.
Members, where you can manage members and update a member's role.

From there, View Drive details takes you into the drive inside Automate, and Open shared drive opens it in Google Drive.

Actions available

Create a shared drive. You must set at least one user or group as manager.
Update drive settings, where sharing and access policies for that drive are set with Enabled and Disabled toggles.
Update org unit, to move a drive into a different organisational unit.
Manage members and roles.
Sync Now, to run the Per-Drive Details Sync for that drive.
Go to Drive, to open it in Google Drive.
Export Drive, which exports the current columns and data.
Rename or delete a drive.

Selecting more than one drive lets you apply an action across all of them: update drive settings, add a member, update organisational unit, or delete. Deselect all clears your selection.

Activity History appears in the drive actions menu and is reserved for a future release.

Shared drive and permission changes are recorded in your audit log.

Browsing folders and files

Open a shared drive to see its details page: statistics and actions in the header, with folder and file browsing beneath.

Navigate folders using breadcrumbs, scrolling continuously through large drives.
Search, filter and sort, and choose which columns to show.
The Bin is available from every screen, so you can see what has been moved there.
Act on a folder or file: manage access, rename, move, copy link, or move to bin.
Open the details panel by clicking a folder or file row, to see sharing settings and members and change permissions in place.

File information is read live from Google each time you browse. Nothing is copied into Automate, so what you see always reflects Google Drive at that moment.

Viewing a user's My Drive

Go to Directory > Users.
Open the user's record.
Select the My Drive tab.

From here you can see the user's files and how much storage they are using, folders and files shared with them, and the Bin. You can act on files, and transfer ownership of a file to another user.

Ownership transfer applies to individual files only. Google does not support transferring ownership of a folder along with its contents, so it is not offered for folders. It also applies to My Drive only, because content in a shared drive is owned by the organisation rather than an individual.

Troubleshooting

Drive Management is not in my sidebar

Either it has not been enabled in CloudM Labs for your domain, or your account does not have administrator access. Check in that order, and speak to your CSM if you need it enabled.

My shared drive list is empty

Check that Automatic Shared Drive Sync is enabled under Settings > Domain Settings > Domain Actions, then check whether a domain sync has run since. Domain sync runs roughly every 48 hours.

A drive's file count or public link count looks out of date

Those figures come from the Per-Drive Details Sync, which runs roughly every five days per drive. Use Sync Now on that drive to refresh them without waiting.

Creating a drive, or moving one between organisational units, fails

This usually means the cloud-identity.orgunits scope is missing from your service account. Both scopes listed in step 2 are required, and these two actions have no fallback. After adding it, allow a few minutes for cached credentials to clear.

Another action on a shared drive fails

Actions on a shared drive need the drive to have an active manager inside your domain. That includes drives whose only manager is an external user or a group, which will not appear in the unmanaged drives filter. Adding an internal user as a manager resolves it. If the action still fails, or you see a permissions error, contact CloudM Support.

Files differ from what I see in Google Drive

File information is read live rather than stored, so a difference is not a sync delay. It usually reflects sharing permissions in Google Drive itself.