Connectors · Google Private Preview

Google Workspace

Rencore monitors Google Workspace across 22 governance policies, 12 reports, and 11 inventories, detecting Drive oversharing, group sprawl, and stale accounts automatically.

Digital Workplace

Published 16 May 2026 For IT Admin, Head of IT, CISO

Google Workspace is in private preview. Join the waiting list and we will reach out when access opens up.

Join the waiting list

Rencore Google Workspace governance is a set of 22 policies, 12 reports, 13 segments, and 11 inventories that continuously audit Google Drive, Docs, Sheets, Sites, Groups, and Chat. It detects files shared publicly via Drive links, groups with external members beyond policy, admin roles assigned without documented justification, and users deactivated in Entra ID who retain Google Workspace access.

64 governance capabilities: 11 inventories · 22 policies · 12 reports · 13 segments · 5 automations

Why govern Google Workspace with Rencore

Control Drive sharing

Detect files shared publicly via link, documents accessible to anyone with the URL, and sharing patterns that bypass organizational data protection policies. Prioritize findings by file sensitivity.
Manage groups and membership

Find groups with external members, groups without assigned owners, and chat spaces with stale membership. Reports show group activity trends and membership patterns.
Enforce user lifecycle

Identify users deactivated in Entra ID who still have active Google Workspace access, admin roles assigned beyond policy, and accounts without recent sign-in activity.
Unify cross-platform governance

Organizations using Google Workspace alongside Microsoft 365 get a single governance view. Rencore links Google users to M365 identities by email for consistent cross-platform oversight.

What Rencore discovers

Rencore automatically inventories these Google Workspace object types.

Google Workspace Tenant

Top-level Google Workspace tenant; root container for users, groups, drives, and Chat spaces.
Google User

Individual Google Workspace user account.
Google Org Unit

Organizational unit within the Google Workspace tenant.
Google Shared Drive

Shared (Team) Drive in Google Drive.
Google Drive File

Any file in Google Drive; discriminated by mime type.
Google Doc

Google Docs document (mimeType=application/vnd.google-apps.document).
Google Sheet

Google Sheets spreadsheet (mimeType=application/vnd.google-apps.spreadsheet).
Google Folder

Google Drive folder (mimeType=application/vnd.google-apps.folder).
Google Site

Google Site (mimeType=application/vnd.google-apps.site).
Google Group

Directory group in Google Workspace.
Google Chat Space

Google Chat space (rooms, group conversations).

Google Workspace inventory card in Rencore

How Google Workspace governance works in Rencore

Rencore connects to Google Workspace via Google Admin and Drive APIs, inventorying files, folders, sharing links, users, groups, admin roles, and chat spaces. It links Google users to M365 users by email for cross-platform identity governance. Policies run on every scan cycle and flag sharing, access, and lifecycle violations.

Who uses Google Workspace governance

IT administrators use it to maintain clean Drive sharing hygiene and manage group lifecycle. CISOs rely on external sharing policies to detect data exposure risks across Google and Microsoft platforms. Heads of IT use reports to compare governance posture between Google Workspace and Microsoft 365.

Getting started

Provide Rencore with Google Workspace Admin API credentials. All 22 policies activate on first scan, covering Drive, Groups, Chat, and user accounts. Rencore links Google users to Entra ID automatically.

Policies

22 governance rules that detect violations and risks.

Severity Category

Drive file shared with anyone-with-link

Detects active Drive files where the link grants access to anyone (any internet user).

High External Access
Drive file shared outside the domain

Detects active Drive files with at least one permission granted to users outside the tenant domain.

High External Access
Shared Drive allows external members

Detects Shared Drives where the domain-users-only restriction is disabled.

High External Access
Shared Drive without domain restriction holds content

Detects Shared Drives where the domain-users-only restriction is disabled and the drive contains files.

High External Access
Admin with domain-wide delegation enabled

Detects super admins that also have domain-wide delegation flagged.

High Security
Google Group with external members

Detects Google groups with at least one member outside the tenant domain.

Medium External Access
Drive file owned by suspended user

Detects Drive files whose owner is a suspended Google account.

Medium Operation
Suspended Google user is still active in Entra ID

Detects users suspended in Google Workspace whose linked Entra ID account remains enabled.

Medium Operation
Drive link without expiration

Detects anyone-with-link shares that have no expiration date.

Medium External Access
Google user without 2-step verification

Detects active non-admin Google users that have not enrolled in 2-step verification.

Medium Security
Suspended user still consumes a license

Detects suspended-but-not-archived users that still occupy a paid Google Workspace seat.

Medium Costs
Google user over storage quota

Detects active Google users whose storage usage exceeds their assigned quota.

Medium Costs
Active Google user has never signed in

Detects active users with no recorded sign-in event.

Low Adoption
Empty Shared Drive

Detects Shared Drives with zero files.

Low Sprawl
Empty Google group

Detects Google groups with zero direct members.

Low Sprawl
Inactive Chat space

Detects named Chat spaces with fewer than 2 members.

Low Sprawl
Stale Drive file (>365 days)

Detects active Drive files not modified in 365+ days.

Low Sprawl
Oversized Drive file (>500 MB)

Detects active Drive files larger than 500 MB.

Low Sprawl
Empty Organizational Unit

Detects OrgUnits with zero member users.

Low Sprawl
Abandoned Chat space (>180 days)

Detects Chat spaces with no activity in the last 180 days.

Low Sprawl
Drive file shared with allUsers (publicly discoverable)

Detects active Drive files marked as discoverable to anyone on the internet.

Critical Information Oversharing
Super admin without 2-step verification

Detects active admins who are not enrolled in 2-step verification.

Critical Security

Need a rule that isn't listed? Rencore's Policy Builder lets you create custom policies tailored to your organization. Learn more about the Policy Builder

Reports

12 analytics views and dashboards.

External Drive shares over time

Count of externally shared Drive files created per month over the last 12 months.

Line Chart · External Access
Drive files by Shared Drive

Top 10 Shared Drives by file count.

Bar Chart · Operation
Top Google groups by membership

Top 10 Google groups ranked by direct member count.

Bar Chart · Operation
Chat spaces by type

Distribution of Chat spaces across SPACE, GROUP_CHAT and DIRECT_MESSAGE types.

Donut Chart · Operation
2-step verification adoption

Active Google users by 2-step verification enrollment status.

Donut Chart · Security
Top users by storage used

Top 10 active Google users ranked by storage consumed.

Bar Chart · Costs
Users by admin status

Active Google users split by admin vs non-admin status.

Donut Chart · Security
Shared Drives with external members

Top 10 Shared Drives ranked by external member count.

Bar Chart · External Access
Drive files by MIME type

Distribution of non-trashed Drive files across MIME types.

Donut Chart · Operation
Users by org unit

Top 10 organizational units ranked by user count.

Bar Chart · Operation
Groups with external members

Top 10 Google groups ranked by external member count.

Bar Chart · External Access
Suspended users over time

Count of suspended user accounts created per month over the last 12 months.

Line Chart · Security

Google Workspace reports card in Rencore

Automations

5 automated remediation workflows.

Remove Drive External Share

Removes all anyone-with-link permissions from a Drive file after approval.
Delete Google Group

Deletes a Google directory group after approval.
Delete Empty Shared Drive

Deletes a Shared Drive that contains no files after approval.
Transfer Drive File Ownership

Transfers ownership of a Drive file to a designated archive user after approval.
Delete Chat Space

Deletes an inactive Google Chat space after approval.

Segments

13 data groupings for targeted filtering.

Externally shared Drive files

Drive files with at least one permission granted outside the tenant domain.
Public Drive files

Drive files marked as discoverable to anyone on the internet.
Suspended Google users

Users marked as suspended in Google Workspace.
Google Workspace admins

Users with admin privileges in Google Workspace.
Admins without 2-step verification

Admin users who have not enrolled in 2-step verification.
Google groups with external members

Google groups containing at least one member outside the tenant domain.
Empty Shared Drives

Shared Drives that contain no files.
Inactive Chat spaces

Named Chat spaces with fewer than 2 members.
Google users without 2-step verification

Active Google users that have not enrolled in 2-step verification.
Stale Drive files (>365 days)

Drive files not modified in the last 365 days.
Large Drive files (>500 MB)

Drive files exceeding 500 MB in size.
High-storage Google users (>90%)

Google users whose storage usage exceeds 90% of their assigned quota.
Shared Drives without domain restriction

Shared Drives that allow non-domain members and contain at least one file.

Frequently asked questions

What governance areas does Rencore cover?

Rencore covers six governance pillars: visibility and inventory across all Microsoft 365 services, ready-to-go policies with over 100 pre-built governance checks, compliance and audit evidence collection for regulatory requirements, extensibility and customization through custom policies and automations, cross-department collaboration with shared dashboards and role-based access, and AI and Copilot readiness to prepare tenants for secure AI adoption.

What is Rencore governance?

Rencore governance is a SaaS platform that continuously monitors your Microsoft 365 tenant for policy violations, configuration drift, and security risks across SharePoint, Teams, Power Platform, Copilot, and AI Agents. It automates compliance evidence collection, surfaces oversharing and sprawl, and provides actionable remediation workflows, reducing manual audit effort by up to 80%.

How do Rencore policies work?

Rencore ships with hundreds of pre-built policies that detect governance violations across every connector, oversharing, sprawl, cost overruns, security risks, and compliance gaps. Policies run on a continuous schedule, evaluate each discovered object against configurable rules, and flag violations with severity (High, Medium, Low), category, and a recommended action.

Trusted by

Why govern Google Workspace with Rencore

Control Drive sharing

Manage groups and membership

Enforce user lifecycle

Unify cross-platform governance