Drive Management gives administrators a single place in Automate to see and manage the shared drives across their domain, browse the files inside them, view an individual user's My Drive, and review what has been happening in Google Drive. All without leaving Automate or signing in as the user.
This article covers what your tier includes and how to set Drive Management up. For how to use it once it is running, see Drive Management: shared drives, files and activity.
What your tier includes
Drive Management is included from the Essential tier upwards, and is only available to administrators. What you can do depends on your tier.
| Tier | My Drive | Shared drives | Acting on shared drives | Bulk actions |
|---|---|---|---|---|
| Signatures | No access | No access | No | No |
| Essential | Full control | View only | No | No - View Only |
| Pro | Full control | Full visibility | Yes, one drive at a time or up to 50 selected on screen | No - View Only |
| Enterprise | Full control | Full visibility | Yes, no page limit | Yes |
Essential
For seeing what you have and fixing individual users. Full control of any user's My Drive, read-only visibility of shared drives across your domain including the risk data (external members, public link sharing, ownerless drives), and activity history. Can only view bulk actions.
Pro
Everything in Essential, plus acting on the shared drives themselves: reassign an orphaned drive, remove or downgrade an external member, fix sharing, empty trash, rename, move between organisational units, or delete. You can also apply an action to up to 50 drives ticked on screen. Can only view bulk actions.
Enterprise
Everything in Pro, plus bulk actions across your whole filtered estate with no page limit, and recommendation cards that act on every drive matching their condition.
Drive Management is no longer requested through CloudM Labs. Access is set by your tier, so there is nothing to switch on.
Setting it up
Two things need doing once your tier includes Drive Management.
1. Configure a domain-wide delegation service account
Drive Management uses a service account from your own Google Cloud project rather than the default shared one. This gives it access to scopes that cannot be added to the default setup, and keeps the Drive API work for your domain in your own project.
- Go to Settings > Domain Settings > Domain Wide Delegation.
- Upload your service account.
- Run validation with the Drive Management option selected.
In the Google Admin console, the service account's client ID needs both of these scopes delegated to it:
https://www.googleapis.com/auth/drive
https://www.googleapis.com/auth/cloud-identity.orgunitsThe Cloud Identity API and the Google Drive API also need to be enabled in the Google Cloud project that hosts the service account.
Both scopes are required and there is no fallback. The cloud-identity.orgunits scope is what allows a shared drive to be created or moved between organisational units. If it is missing, those two actions fail straight away rather than falling back to the default service account.
Credentials are cached, so allow a few minutes after changing the service account or its scopes before testing.
2. Turn on shared drive sync
Drive Management works from a synchronised inventory of your shared drives, so sync needs enabling before the list will populate.
- Go to Settings > Domain Settings > Domain Actions.
- Enable Automatic Shared Drive Sync.
Waiting for the first sync
Shared drives are synchronised as part of your existing domain sync, under Settings > Domain Settings > Domain synchronisation, alongside users, groups and organisational units. Sync collects shared drive information such as name, organisational unit, and members and permissions.
Until the first sync completes, the Shared Drives list will be empty or incomplete.
The sync is one way. It reads from Google Workspace into CloudM. Changes you make in CloudM are sent straight to Google as separate actions.
When domain sync finds a new drive, its first details sync is normally picked up within about 20 minutes. Manual Sync runs the per-drive details sync for one drive without waiting. A small drive finishes in seconds; larger drives, or busy periods, take longer. With automatic sync on, your basic drive information and membership are already current, so Manual Sync is mainly useful for refreshing file and public link counts sooner.
Three things that sound similar
- Refresh asks for the latest data already stored in CloudM. It does not contact Google.
- Sync pulls data from Google into CloudM. It does not send CloudM data to Google.
- Actions, such as creating or renaming a drive, go straight from CloudM to Google.
Shared drive sync only runs when a feature that needs it is switched on, so there is no extra load on domains not using Drive Management.
Opening Drive Management
Once your tier includes it, a Drive Management group appears in the Automate sidebar, containing Shared Drives and Activity History.
From here, see Drive Management: shared drives, files and activity.
Troubleshooting setup
Drive Management is not in my sidebar
Either your tier does not include it, or your account does not have administrator access. Check in that order. It is included from Essential upwards, so it will not appear on the Signatures tier. Speak to your CSM about upgrading.
An action I expect is greyed out
Greyed-out actions with an upgrade prompt are working as intended. Acting on shared drives needs Pro or above; bulk actions need Enterprise.
My shared drive list is empty
Check that Automatic Shared Drive Sync is enabled under Settings > Domain Settings > Domain Actions, then check whether a domain sync has run since. Domain sync runs roughly every 48 hours.
Creating a drive, or moving one between organisational units, fails
This usually means the cloud-identity.orgunits scope is missing from your service account. Both scopes are required and these two actions have no fallback. Allow a few minutes after adding it for cached credentials to clear.