---
title: "Identify Shared-in Google Drive Files from External users"
description: "## Identify Shared-in Google Drive Files from External users **What does Shared-in mean?** A Shared-in file is a file where the owner is an external user from another Google Workspace domain. This external owner may have added a user from…"
url: "https://gatlabs.com/knowledge/tech-tips/identify-shared-in-google-drive-files-from-external-users/"
updated: "2025-02-07"
category: "Drive Audit & Management"
tags:
  - GAT+
---

# Identify Shared-in Google Drive Files from External users

## Identify Shared-in Google Drive Files from External users

**What does Shared-in mean?**

A Shared-in file is a file where the owner is an external user from another Google Workspace domain. This external owner may have added a user from your Google Workspace domain as an Editor, Viewer, or commenter.

These users appear within GAT+ **highlighted**in**orange color, **and if they own the file their email appears under the **Owner** heading.

Navigate to the **GAT+ → Drive audit → Files tab**.

![](https://gatlabs.com/knowledge/wp-content/uploads/2021/11/2025-02-07-09_53_18-Window.png)

**Note:** If Shared Drive is shown (as green background) it means the Shared Drive itself has (Managers who are external to the domain) 

**Why are Shared-in files important to analyze?**

- Data Leak - Files placed into a shared-in folder are immediately exposed to an external party.
- Identify the type of organizations collaborating with your business.
- Reach out to the external organization and let them know that their users are sharing files with members of your organization.

#### 'First seen in GAT+'

In the GAT+, Files tab, we provide the following Search Operators, when defining your custom filter to query the metadata across your organization.

- **First seen in GAT+**
- **First seen in GAT+ (relative) **

These Search Operators combined with another like the **Sharing Flag***contains***Shared-in **can tell **when** (time & date) the file was first recognized by GAT+.

**Note**: 'First seen in GAT+' is a Search Operator unique within GAT+, Google API does not keep track of Shared-in files so GATLabs has developed unique code to identify these files.

![](https://gatlabs.com/knowledge/wp-content/uploads/2021/11/2022-10-19-13_44_54-Window.png)

**The outcome of the above Custom filter**

This will show you all the files that were:

- **“Shared in” to your Google Workspace domain in the last 30 days.**

![GAT+ | Identify Shared-in Google Drive Files from External users 2](https://gatlabs.com/wp-content/uploads/2021/06/screenshot-uk.generalaudittool.com-2021.06.02-17_01_58-1.png)

### Creating a scheduled report to find recently shared-in files

Using the same custom filter and same Search Operators, we can schedule our filter to create daily, weekly, or monthly generated spreadsheets.

![](https://gatlabs.com/knowledge/wp-content/uploads/2021/11/screenshot-gs.generalaudittool.com-2021.11.16-19_32_06-1024x852.png)

This scheduled report will produce a Google Spreadsheet of the most recently shared-in files over the last month.

### Summary

As a result of the filer and report you will see:

- On a scheduled occurrence (daily, weekly or monthly), a new report will be generated.
- The Google Sheet will contain all the newly discovered Shared files for the previous X days
- Below you will see the Owner (is external) – meaning it’s Shared In. Also, the Sharing flag contains Shared-in (Shared into your domain from an external domain).

![GAT+ | Identify Shared-in Google Drive Files from External users 6](https://gatlabs.com/wp-content/uploads/2021/06/screenshot-docs.google.com-2021.06.02-17_05_23.png)