Google Shared Drive Roles and Permissions Explained: Complete Admin Guide

Google Shared Drives help organizations collaborate on files without relying on individual employees to maintain ownership of important business documents.

However, choosing the wrong access level can expose sensitive information, allow unauthorized sharing, or give users more permissions than they need.

Google Workspace provides five main Shared Drive roles: Manager, Content manager, Contributor, Commenter, and Viewer.

Understanding the differences between these roles is essential for IT administrators responsible for managing access, securing shared documents, and maintaining business continuity.

In this guide, we explain how Shared Drive permissions work, which roles to assign, and how to avoid common security mistakes.

AI Summary: Google Shared Drive Roles and Permissions

Google Shared Drives have five access levels: Manager, Content manager, Contributor, Commenter, and Viewer.

• Manager: Manages the Shared Drive, including membership, settings, and content.
• Content manager: Creates, edits, organizes, moves, and deletes files, subject to restrictions.
• Contributor: Creates and edits content but cannot normally move or delete existing files.
• Commenter: Views files and adds comments without editing their content.
• Viewer: Can view files without modifying them.

Unlike files stored in My Drive, files in a Shared Drive belong to the organization rather than an individual employee.

For security, organizations should follow the principle of least privilege, limit Manager access, review external sharing, and regularly audit Shared Drive membership.

MOZAYK Workspace helps administrators manage Google Workspace users, groups, and access-related information through a centralized administration interface.

1. What Is a Google Shared Drive?

A Google Shared Drive is a collaborative storage space available in supported Google Workspace editions.

Unlike My Drive, where files typically belong to individual users, Shared Drives use organization-based ownership.

This distinction is particularly important when employees change roles or leave the organization.

For example, imagine a sales manager creates customer proposals in their personal Google Drive.

If the employee leaves, administrators may need to transfer the files to another user.

With a Shared Drive, documents remain associated with the organization, even when the employee who uploaded them is removed from the drive.

My Drive vs Shared Drives

Shared Drives are especially useful for departments, project teams, HR, finance, and other groups that need long-term access to business documents.

2. The Five Google Shared Drive Roles

Google Shared Drives use five main membership roles.

Manager

The Manager role provides the highest level of control within a Shared Drive.

A Manager can generally:

• Add and remove Shared Drive members.
• Change member access levels.
• Manage Shared Drive settings and restrictions.
• Create, edit, organize, and delete content.
• Manage access to files and folders.
• Move supported content into or out of Shared Drives.

Managers can also configure restrictions affecting external sharing and certain content operations.

Security recommendation: Assign Manager access only to users responsible for administering the drive.

Not every department member needs this level of permission.

Content manager

Content managers can generally create, edit, organize, move, and delete files within a Shared Drive.

This role is suitable for employees responsible for maintaining a department's documents and folder structure.

For example, an operations coordinator might need Content manager permissions to organize project documentation and maintain shared resources.

However, Content managers do not have the same level of control over Shared Drive membership and settings as Managers.

Certain sharing operations may also depend on the drive's restrictions.

Contributor

Contributors can create and edit files, but their ability to reorganize or delete existing content is restricted.

This role is useful when employees need to collaborate on documents without being responsible for managing the overall folder structure.

For example, a sales representative might need to edit proposals and upload new files but should not be able to delete the department's shared documentation.

Contributor access can provide a useful balance between collaboration and control.

Commenter

Commenters can view files and add comments where supported.

They cannot directly edit document content or reorganize the Shared Drive.

This role is suitable for reviewers, supervisors, or stakeholders who need to provide feedback without modifying source documents.

Viewer

Viewers can access and read content without editing it.

This is generally the least privileged Shared Drive membership role.

It is suitable for users who need access to reference documentation, published procedures, or final project deliverables.

Depending on the configured restrictions, downloading, copying, and printing may also be limited.

3. Google Shared Drive Permissions Comparison

The following table summarizes the main capabilities of each role.

This table summarizes common role capabilities. Specific operations may depend on administrator policies, item permissions, folder restrictions, and the Google Workspace interface being used.

For example, certain Contributors may be able to work with files using the web interface but need Content manager access for particular operations in Google Drive for desktop.

4. Content Manager vs Contributor: Which Should You Choose?

This is one of the most important permission decisions for Shared Drive administrators.

Both roles allow users to create and edit files.

However, Content managers have broader control over how content is organized and maintained.

Choose Content manager when users need to:

• Maintain the folder structure.
• Move documents between folders.
• Remove obsolete documents.
• Organize team resources.
• Manage day-to-day document organization.

Choose Contributor when users need to:

• Create documents.
• Upload files.
• Collaborate on existing content.
• Work without managing the overall folder structure.
• Avoid unnecessary deletion privileges.

Recommended approach: Use Contributor for routine collaboration when its limitations are acceptable, and Content manager for employees responsible for maintaining the Shared Drive's content.

This reduces unnecessary privileges without preventing users from completing their work.

5. How to Change Shared Drive Permissions

To change a member's access level:

1. Open Google Drive.
2. Select Shared drives.
3. Open the Shared Drive you want to manage.
4. Select Manage members from the drive's menu.
5. Locate the user or group.
6. Select the appropriate access level.
7. Save the changes.

You generally need Manager access or the appropriate administrative authority to manage drive membership.

If the option is unavailable, check your current role and your organization's policies.

Can Google Groups Be Used?

Yes.

Google Groups can be used to manage access to Shared Drives.

Instead of adding every employee individually, an administrator can grant access to a group representing a department or project team.

For example:

• finance@company.com
• marketing@company.com
• operations@company.com

This can simplify access management when employees join or leave teams.

However, administrators must also maintain group membership correctly.

A group with outdated or unauthorized members can create the same security risks as individually assigned permissions.

6. Shared Drive Membership vs Individual File Permissions

Shared Drive membership provides access to the drive and its content, subject to supported limited-access folders and other restrictions.

Users may also receive permissions on specific files or folders.

This creates two important levels of access:

Drive-level permissions: Access associated with membership in the Shared Drive.

Item-level permissions: Access granted to particular files or folders.

Administrators must understand how inherited permissions work.

For example, granting someone access to an entire Shared Drive can expose considerably more information than sharing a single document.

Likewise, removing an individual file permission may not remove access inherited through Shared Drive membership or a Google Group.

What About Limited-Access Folders?

Google Workspace supports limited-access folders in certain Shared Drive scenarios.

They allow access to specific folders to be restricted to authorized users instead of automatically exposing their contents to every drive member.

Managers can configure these restrictions, subject to the supported features and policies.

For sensitive information, a separate Shared Drive or a carefully configured limited-access folder may be more appropriate than broad membership access.

7. External Sharing and Shared Drive Security

External sharing is one of the main security considerations for Google Shared Drives.

A document may be shared with a customer, contractor, partner, or external consultant.

These collaborations can be legitimate, but permissions should be reviewed regularly.

Administrators should examine:

• External users with access to Shared Drives.
• Google Groups containing external members.
• Public or link-based sharing settings.
• Sensitive files shared outside the organization.
• Permissions retained by former contractors.
• Shared Drive restrictions.

An important distinction is that Google Workspace administrators can configure organization-wide sharing policies, while Shared Drive Managers can control certain settings within the limits established by administrators.

A Common Security Mistake

Imagine an external contractor receives access to an entire project drive instead of a single folder.

Even if the contractor only needs three documents, broad membership may expose additional files.

The safer approach is to grant the minimum access required for the task and review it when the project ends.

8. What Happens When an Employee Leaves a Shared Drive?

One of the main benefits of Shared Drives is continuity of ownership.

When an employee leaves a Shared Drive or their account is removed, files stored in that drive remain associated with the organization.

However, this does not mean offboarding can be ignored.

Administrators still need to:

1. Remove or suspend the employee's account as appropriate.
2. Review Google Groups membership.
3. Revoke unnecessary access.
4. Check files remaining in the employee's My Drive.
5. Review externally shared content.
6. Examine connected third-party applications.
7. Transfer business-critical content where necessary (see our guide on how to transfer ownership of Google Drive files).

Connected applications deserve their own review: our guide on auditing third-party apps in Google Workspace explains how.

Shared Drives reduce dependence on individual ownership, but they do not replace a complete offboarding process.

9. Best Practices for Google Shared Drive Administration

We recommend implementing the following practices.

Limit Manager Access

Avoid assigning Manager permissions to every team member.

Designate a limited number of responsible individuals and ensure suitable continuity if a Manager becomes unavailable.

Organize Shared Drives by Team or Project

Create a clear structure for departments, projects, and business processes. For repeatable project setup, see how to duplicate a Google Drive folder structure with reusable templates.

Avoid mixing highly confidential content with broadly accessible working documents.

Use Groups for Access Management

Where appropriate, grant permissions through Google Groups rather than maintaining large numbers of individual entries.

Review group membership regularly.

Review External Access

Identify external collaborators and verify whether their access is still justified.

Apply Least Privilege

Assign the lowest access level compatible with each user's responsibilities.

Audit Membership Periodically

Review Shared Drive members after reorganizations, project completions, and employee departures.

Document Exceptions

Where broader access is necessary, record the reason and review it periodically.

10. Managing Google Workspace Access with MOZAYK Workspace

Managing access across a growing Google Workspace environment can become increasingly complex.

Administrators must consider users, groups, aliases, permissions, and the lifecycle of employee accounts.

MOZAYK Workspace provides a centralized interface for Google Workspace administration and security-related controls.

Its features help administrators work with user and group information, manage administrative operations, and review aspects of their Google Workspace environment.

For Shared Drive governance, this centralized approach complements the native Google Workspace administration tools.

The objective is to reduce operational complexity and help administrators maintain better visibility over their environment.

MOZAYK Workspace does not replace Google's native permission model or automatically guarantee that every Shared Drive is securely configured.

Frequently Asked Questions

What are the five Google Shared Drive roles?

The five roles are Manager, Content manager, Contributor, Commenter, and Viewer. Each role provides a different level of control over files, membership, and drive settings.

What is the difference between Manager and Content manager?

Managers control Shared Drive membership and settings as well as content. Content managers can organize and maintain files but cannot generally administer drive membership or change its restrictions.

Can Contributors delete files from a Shared Drive?

Contributors cannot normally move existing files to Trash or reorganize them. Content managers and Managers have broader content management permissions.

Can a Viewer download files from a Shared Drive?

By default, viewing access can allow downloading, but administrators and Shared Drive Managers can apply restrictions to supported content and roles.

Who owns files in a Google Shared Drive?

Files belong to the organization or team represented by the Shared Drive, not to the individual employee who uploaded them.

Can external users access Google Shared Drives?

Yes, if the organization's Google Workspace policies and the Shared Drive's restrictions allow external access.

Can you restrict access to a folder inside a Shared Drive?

Yes. Supported limited-access folders allow administrators or authorized Managers to restrict access to particular folders.

Should administrators use Google Groups for Shared Drive access?

Google Groups can simplify membership management, especially for departments and project teams. Group membership must still be reviewed and maintained.

What happens to Shared Drive files when an employee leaves?

The files remain in the Shared Drive. Administrators should still revoke the employee's access and review any business files stored in My Drive.

How can MOZAYK Workspace help with Google Workspace permissions?

MOZAYK Workspace centralizes Google Workspace administration features, including users, groups, and access-related information, helping IT teams maintain a clearer view of their environment.

Conclusion

Google Shared Drive permissions are fundamental to secure collaboration.

Choosing the correct access level helps prevent unnecessary changes, excessive sharing, and unauthorized access.

For most organizations, the best approach is to limit Manager permissions, use Content manager or Contributor roles according to operational needs, and review memberships regularly.

MOZAYK Workspace helps simplify Google Workspace administration with a centralized interface for managing users, groups, and security-related information.

Simplify Google Workspace Administration

Manage your Google Workspace environment with greater visibility and control.

Discover MOZAYK Workspace and start your 30-day free trial.

Start your free trial

Official Google Documentation

• How file access works in shared drives
• What are shared drives?
• Best practices and tips for shared drives
• Create a shared drive