Restrict access to Shared Drive by OU

[Hadia]

Is there a way to restrict access to a Shared Drive by OU ?

[cryptochrome · Accepted solution]

The key thing to understand here - in my opinion - is that OUs are not really designed to control access to particular Shared Drives. OUs allow you to set different sharing settings, restrictions, etc. based on OU - but if you want to control who gets access to which Shared Drives, your best option is using groups, not OUs. 

[icrew]

You can do this with the free, open source, command-line, indispensable GAM tool. Check out:

• GAM: https://github.com/jay0lee/GAM/wiki
• GAM Advanced (a variant with a few more features): https://github.com/taers232c/GAMADV-XTD3/wiki
• and the mailing list at https://groups.google.com/forum/#!forum/google-apps-manager

for more details.

Specifically, you can use GAM to sync the members of an OU into a Group, then add that Group as a member of the Shared Drive. See https://github.com/GAM-team/GAM/wiki/GAM3DirectoryCommands#sync-members-managers-owners-to-a-group for how. 

Hope that helps,

Ian

[cryptochrome]

And you don't even need to use external tools 🙂   You can do it easily through the admin console as well. Here is how:

https://support.google.com/a/answer/7337635

[Hadia]

Thank you so much for your link ! But still ambiguous to me... actually I would like to know if inside a domain you can apply any rule that would give access to a Shared Drive to OU 1 and not to OU 2 (and avoinding users from OU 1 to share to users from OU 2) ?

"If you want the data protection rules set for an organizational unit to apply to certain shared drives, you can assign the shared drives to that organizational unit so that the same data protection rules apply. "

[cryptochrome · Accepted solution]

The key thing to understand here - in my opinion - is that OUs are not really designed to control access to particular Shared Drives. OUs allow you to set different sharing settings, restrictions, etc. based on OU - but if you want to control who gets access to which Shared Drives, your best option is using groups, not OUs. 

[Hadia]

OK many thanks that's precisely what I wanted to know 🦄 !

[goldyarora · Accepted solution]

@Hadia - consider Drive test rules (currently in open beta):

https://support.google.com/a/answer/10621317?hl=en

[Hadia]

Thank you ! Use case solved !

[KAM]

@Hadia and others, you might be interested in this update from a few days ago: https://workspaceupdates.googleblog.com/2022/05/shared-drives-in-organizational-units-open-beta.html -KAM