Back to Checks
googleworkspace

Users are allowed to create new shared drives

drive_shared_drive_creation_allowed
Service: driveSeverity: medium
OfficialBuilt-inVerified
Resource Type:NotDefined

The domain-wide default allows users to create new shared drives. Shared drives are owned by the organization (not the individual user), so content stored in them survives the deletion of the original creator's account, supporting data continuity and reducing the risk of accidental data loss.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

When users cannot create shared drives, they store collaborative content in their personal My Drive instead. When that user account is deleted, the data is also deleted, leading to unintentional data loss of organizationally significant information. Allowing shared drive creation makes data survivable across account lifecycle events.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks drive_shared_drive_creation_allowed

Recommendation

Allow users to create new shared drives. This protects the organization from data loss when user accounts are deleted by ensuring collaborative content lives in organization-owned shared drives instead of personal My Drive folders.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Drive and Docs**
3Click **Sharing settings** > **Shared drive creation**
4*Uncheck** *Prevent users in <Company> from creating new shared drives*
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.drive.drive_client import drive_client


class drive_shared_drive_creation_allowed(Check):
    """Check that users are allowed to create new shared drives

    This check verifies that the domain-level Drive and Docs policy permits
    users to create new shared drives. Allowing shared drive creation helps
    prevent data loss when individual user accounts are deleted, since
    content lives in shared drives owned by the organization rather than
    in personal My Drive folders.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if drive_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=drive_client.policies,
                resource_id="drivePolicies",
                resource_name="Drive Policies",
                customer_id=drive_client.provider.identity.customer_id,
            )

            allow_creation = drive_client.policies.allow_shared_drive_creation

            if allow_creation is True:
                report.status = "PASS"
                report.status_extended = (
                    f"Users in domain {drive_client.provider.identity.domain} "
                    f"are allowed to create new shared drives."
                )
            elif allow_creation is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Shared drive creation uses Google's secure default "
                    f"configuration (allowed) "
                    f"in domain {drive_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Users in domain {drive_client.provider.identity.domain} "
                    f"are prevented from creating new shared drives. "
                    f"Users should be allowed to create new shared drives to avoid "
                    f"data loss when accounts are deleted."
                )

            findings.append(report)

        return findings

References