Is there any way to restrict access subfolder on Google shared drive

[daolt]

Hi there!

I have a folder on shared drive, that contains some subfolder, each subfolder allows a role to access, and I have a big group contain all groups (roles) as well. And now I want grant permission for the big group access to parent folder and the roles access to corresponding subfolder (the same way I have done on Active Directory). But when grant the big group to parent folder then all roles access all subfolder. So is there any way to fix it.

Thank in advanced.

[icrew · Accepted solution]

No, it’s not possible. Shared Drives use what’s commonly referred to as a “waterfall” permissions model. While many of the specific details are different, Google’s competitor Box has a really good explanation of the concept in the video over at https://support.box.com/hc/en-us/articles/360043697254-Understanding-Folder-Permissions

Hope that helps,

Ian

[daolt]

Thank you so much!

[ginamar82]

It is possible if you manually remove access to each person that you don't want to have access.  Depending on how many people you have it could be quite tedious.

[waynevoogt]

Hi, I posted this same problem in another topic thread.  Here but this topic is exactly the problem I am facing too. 

What I find difficult is the "Shared Drive" follows this "waterfall" permissions logic BUT the "My Drive" does not. My Drive acts like an  old server setting with regards to permission settings. 

So Google Workspace really has two systems of logic when it comes to permission/share settings. 

Does anyone know when Google may change this?

Here's the logic I've got

Hi all, the problem I experience with Shared Drives is that I wish to set it up like a directory tree of a server (old school possibly). I can do this in "My Drive" with folders, but not in Shared Drive. In My Drive, I can give "all_staff@school.com" access to the top level folder, then create a folder below like "Secondary School" and "Elementary School" then only give access to the "Sec_school_teachers" group (and same for Elem). That way the various teachers only get access to the main folder and then their folders. Super, BUT with "My Drive" it's tied to my account, or my generic account (like ict_director). So when either of those accounts are deleted all the files and fodlers are gone.....

Enter "Shared Drives" for the safety and longevity and continuity of folders and files being there even when the account (individual or generic) is deleted. Superb way to protect files and folders..... HOWEVER, using a "Shared Drive" I create a Shared Drive called "School Server" then add respective folders beneath that for the Schools, Finance, Board etc. Then at the highest level ("School Server") I add all_staff@school.com (which is a product of multiple groups) then I want to go and restrict access to the folders beneath that (within the "School Server" drive) and I cannot. Everyone who allowed "View access" to the "School Server" drive can click through each and every folder and open every file in the Shared Drive. ie. a top down permission levels setting within a Shared Drive does not work, but within "My Drive" it does.... Very frustrating.... Is my logic/thinking missing something. The very permissions structure that makes sense to me is possible within "My Drive" but not within "Shared Drives"

So then within "Shared Drives" and the "School Server" drive I did tried the opposite.... I gave no one permission to the Shared Drive called "School Server" but did give them permission to the folders within. This works HOWEVER, next problem, is that because they are not on the Shared drive, then cannot visibly see the "School Server". Now the shared folder (lets say "Secondary Schoo") needs to searched for (it doesn't even show under "Shared with me").... then, once found, needs be added as a shortcut to their My Drive....

It's driving me a bit nuts....

I did think that maybe I ought to see the "Shared Drive" (highest level) as the "School Server" Shared drive, but only those who are Sec teachers see that their is a Secondary Folder etc. I really, really want everyone in the school to see all of the folder structure (in the "Shared Drives") but only have access to the ones relevant to them..... 

If anyone knows how to do this, or has a work around with shortcuts and permission settings please advise. Much appreciated.

[philip_doolittl]

Like most things from Google, it is delivered half-baked and fully baked will take years to decades.

Example: Google took 15 years to get Tasks half-right and it still lacks very basic functionality. And they practically invented Captcha V3, and this forum still uses V2.