Lock down subfolders with Google Drive's Limited Access feature

Managing Google Drive permissions can be tricky when you want your team to have open access to everything in the drive, but need a few specific files to remain confidential. 

You can't make an individual file more restrictive than the folder it lives in. If someone has Editor access to a shared folder, they automatically have Editor access to every file in that folder. If you try to restrict access to a single file in a shared folder, Google will prompt you to lower that person's access for the entire folder:

The solution: Create a subfolder for your sensitive files and enable Limited Access on that subfolder. This locks down the folder without disrupting the rest of your shared workspace. Here is how to set up Limited Access in both Shared Drives and My Drive. 

How to set up Limited Access in Shared Drives

Because Shared Drives belong to the organization rather than an individual, setting up a restricted folder requires Manager access. Note Shared Drive Managers can never be locked out of a limited access folder.

1. Right-click the subfolder you want to restrict, hover over Share, click Share
2. In the top-right corner of the sharing window, click Settings (gear icon)
   
3. Check the box Limit access to the folder
   
4. Click the back arrow. You will notice that only Shared Drive Managers remain under People with access. Everyone else has been moved into the Access removed tab


5. To grant access to specific people, type their emails into the Add people box and assign their role (Viewer, Commenter, or Contributor).

What your team sees

Members of the Shared Drive who have not been granted access will still see the subfolder exists, but it will appear greyed out with a limited access icon. They can click it to Request access, which sends an email directly to the Drive Managers.

How to set up limited access in My Drive

If you are collaborating out of your personal My Drive, permission controls rest with the Folder Owner, and Editors (if the Editors can change permissions setting is enabled).

1. Right-click your subfolder, select Share, click Share
2. Click the Settings (gear icon)
3. Check Limit access to the folder
4. Click the back arrow. Just like in Shared Drives, everyone except the Folder Owner is moved to the Access removed section.
5. Manually add back the specific individuals who need to see the files, set their permissions and hit Save.

Key things to know about Limited Access

• It only applies to folders, not files. To restrict access to individual files, create a subfolder, turn on Limited Access and move the files inside. 
• Owners and Managers retain full control. Shared Drive Managers and My Drive Folder Owners can never have their access removed from a Limited Access subfolder. 
• Editors and Content Managers need permission to share:
• In My Drive, "Editors can change permissions and share" must be checked in folder settings for Editors to manage Limited Access.
• In Shared Drives, "Allow content managers to share folders" must be turned on in drive settings for Content Managers to manage Limited Access. 
• Restricted folder is always visible to people with general access to the parent drive/folder so people know the folder exists. Restricted users cannot view, open or search for files inside. 

Article by Karen Matthes, Extension Learning Technologies, klm@umn.edu