> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/deployment-guides/your-first-30-days/7-enable-file-security.md).

# 8: Enable Google Drive Security

**Google Drive Security** secures sensitive files synced from Google Drive. It detects files with improper sharing and excessive permissions, external applications with excessive file access, and orphaned file sharing from offboarded accounts, then allows you to take action right from Material.

File detections are enabled immediately and start identifying potential issues right after you connect your tenants, **but you're not yet responding (remediating).** Follow the steps in this guide to configure response and enable remediation.

## Review File Detections

First, familiarize yourself with file-specific detections:

1. From the left navigation, click **Detections**.
2. Click **Filters**, then select **Entity Type**, then **File**.
3. Browse the existing detections, then update your preferred default **Severity** as needed.

<figure><img src="https://content.gitbook.com/content/ksjM8NywYRSHu1IlfxdP/blobs/O0VPUA9i883lIQbQrCoZ/image.png" alt="Detection detail view is a slide out that appears after clicking the detection name"><figcaption><p>Detection detail view</p></figcaption></figure>

## Enable Shared Drive Syncing

To send responses to **Shared Drive Admins**, you need to turn on shared drive syncing. To confirm it's on:

1. From the left navigation, expand **Google Drive Security**, then click **Settings**.
2. Toggle **Shared Drive Syncing** to **On**.

   <figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2Ff2PJrGMiwRfme8b3JJqH%2Fimage.png?alt=media&amp;token=1d1883d9-c289-4cc8-88e1-df6ae199895b" alt="" width="327"><figcaption></figcaption></figure>

## Default Responses

Responses for file detections are configured per detection. Response options include:

<details>

<summary>Add Labels</summary>

Automatically add or remove labels from files that match this detection, like "Sensitive" or "Internal."

The labels themselves are managed in your Google Admin console. In Material, choose from your existing labels.

</details>

<details>

<summary>Send email</summary>

When a file detection creates an issue, you can send an email informing the recipient of the issue and asking them to fix it if needed. Using variables, the default message informs the recipient that a specific file name has an issue, and references the detection name so they know what the issue is. It also includes a link to the file so the recipient can fix the issue.

You can customize these emails as needed, and even send multiple emails in response to one issue separated by a period of time.

</details>

<details>

<summary>Time delay</summary>

You can include a time delay before adding another action.

For example, sometimes sending an initial email then giving the recipient time to fix the issue is the best path. Add a time delay between the initial email and another action:

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2F2bHOhcFGD68RkWRbqvWo%2Fimage.png?alt=media&amp;token=cde0b3eb-da07-4072-a1e0-b48d2123b3f0" alt="" width="304"><figcaption></figcaption></figure>

</details>

<details>

<summary>Update Permissions</summary>

Automatically update permissions on files that match this detection. Remediation only affects the matched files and doesn't update permissions inherited from a parent folder or drive.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FXf4gTXtgvPjUwMwMlmCM%2Fimage.png?alt=media&amp;token=6f89eaed-973a-40cc-be66-623a2073ee9b" alt="" width="190"><figcaption><p>Permissions in Google Docs</p></figcaption></figure>

Options include:

* **Revoke Permissions**
  * Update general access permissions to revoke, viewer, commenter, or editor
  * Update permissions for accounts with direct access (customize to internal and external access)
* **Add Permissions**
  * Select specific Google groups or accounts to assign permissions for this file to

</details>

### Configure Default Response

1. From the left navigation, click **Detections**.
2. Click **Filters**, then select **Entity Type**, then **File**.
3. Browse the existing file detections.
4. Open the detection, then set the default response as needed:

<figure><img src="https://content.gitbook.com/content/ksjM8NywYRSHu1IlfxdP/blobs/jebEgXvM9DIv8IrsyrDL/image.png" alt="detection default response located in detection detail view" width="311"><figcaption></figcaption></figure>

5. Detections are enabled out of the box, so as soon as you set your default response, it's active. From this detection detail view, you can also disable the detection. **At deployment, we recommend you leave detections enabled and let them run before revising them:**

<figure><img src="https://content.gitbook.com/content/ksjM8NywYRSHu1IlfxdP/blobs/LrLanMAAOH7450KkA1vP/image.png" alt="detection enabled toggle on in detection detail view" width="311"><figcaption></figcaption></figure>

{% hint style="warning" %}
At this point, you've configured default responses but you have **not** enabled them completely yet. Follow the steps in [#enable-file-remediation](#enable-file-remediation "mention") below to finish deployment.
{% endhint %}

## Enable File Remediation

Now that you've configured your default responses, enable File Remediation so they take effect.

### Enable Remediation Globally

1. As a super admin, log in to your Material instance.
2. From the top toolbar, click **Settings** <img src="https://content.gitbook.com/content/ksjM8NywYRSHu1IlfxdP/blobs/9xsohDN0mPMM7eBbiqoC/image.png" alt="" data-size="line">, then click **Default Account Settings**.
3. Under **Remediations**, toggle **File Remediation** to **On**.

   <figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2F4aHUbDroEOy1tk2kiDJ7%2Fimage.png?alt=media&amp;token=ed92753d-c7af-4e6f-837f-7b75194ee89c" alt="" width="343"><figcaption></figcaption></figure>

### Enable Remediation Per User or Group

File Remediation follows the global setting by default. You can override it for specific accounts or groups:

* **Disable it for some users:** Turn File Remediation on globally, then turn it off for the accounts or groups you want to exclude.
* **Roll it out gradually:** Leave File Remediation off globally, then turn it on only for the accounts or groups you want to start with. Only those users receive response emails and have their files remediated.

To override File Remediation for accounts or groups:

1. As a super admin, log in to your Material instance. If you're already logged in, navigate to the **Workspace**.
2. Click **Explorer**.
3. Choose **Accounts** to override the setting for specific users, or **Groups** for a group of users.
4. Check the boxes for the accounts or groups you want to change, then click **Edit Settings**.
5. Under **Remediations**, select **Override File Remediation**, then toggle it **On** or **Off**.

   <figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FiUomwhR00hKKlDZp5NUN%2Fimage.png?alt=media&amp;token=708e4e95-0695-4ef8-a574-680d9d86d9ab" alt="" width="364"><figcaption></figcaption></figure>

**Inherit** keeps the global File Remediation setting described above.

{% hint style="info" %}
File Remediation applies the detection's full response to every account where it's turned on. If several groups have File Remediation on, they all get the same response. You can't send emails or apply labels to only one of them. To respond differently for one group, disable the default detection and create a [custom detection](/detections/detections-overview/custom-detections.md) scoped to that group.
{% endhint %}

{% hint style="success" %}
Google Drive Security is now enabled. Before moving on to configure **Account Security**, take a moment to learn about bulk remediation below.
{% endhint %}

## How to Bulk Remediate

Auto-response is best practice. If you need to revoke access manually for any reason, do this in the Explorer. Try this example to familiarize yourself with this process:

1. From the workspace left navigation, click **Explorer**, then **Files**.
2. The Explorer uses MQL, a querying language unique to Material. Use the query builder to search for files with issues. This example uses the query `shared.externally and location.is_my_drive`, built with the Explorer tools:

   <figure><img src="https://content.gitbook.com/content/ksjM8NywYRSHu1IlfxdP/blobs/c0BEyXr2q9WFptR0dt5G/2025-03-20_13-49-05%20(1).gif" alt="search for files in the explorer located in the workspace"><figcaption><p>Search for files in the Explorer. Learn more in <a href="/working-with-issues/explorer/file-search.md">File Search</a>.</p></figcaption></figure>
3. Check the boxes for any files you want to revoke access to immediately, then click **Revoke External Access**:

<figure><img src="https://content.gitbook.com/content/ksjM8NywYRSHu1IlfxdP/blobs/R4KVJS93Spn8kUtW1SSm/image.png" alt="check boxes for files then click revoke external access at the bottom of the screen to revoke external access to multiple files"><figcaption><p>Revoke external access to multiple files</p></figcaption></figure>

4. Select the domains to revoke access to:

<figure><img src="https://content.gitbook.com/content/ksjM8NywYRSHu1IlfxdP/blobs/kda4olRfcO3aGZh9E66Z/image.png" alt="select the domain to revoke access to on this screen by checking the box next to the domain name" width="375"><figcaption><p>Revoke access to a specific domain</p></figcaption></figure>

5. Optionally, toggle on **Set General Access to Restricted**:

<figure><img src="https://content.gitbook.com/content/ksjM8NywYRSHu1IlfxdP/blobs/PuMIbyuy00cBzBLnbnBx/image.png" alt="toggle used to set general access to restricted" width="375"><figcaption><p>Toggle on to Set General Access to Restricted</p></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.material.security/getting-started/deployment-guides/your-first-30-days/7-enable-file-security.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.