Export your organization’s Drive inventory

As an administrator, you can have your organization’s Google Drive inventory exported to BigQuery. The inventory includes metadata associated with each file, such as size, applied labels, and who it is shared with, but not the content of the files. You can review this information to assess if access to sensitive files meets your organization’s regulatory, compliance, and data security goals.

When your Drive inventory is in BigQuery, you can create custom reporting and dashboards using analytics tools like Looker Studio and third-party visualization partners.

Note:

• Some of the steps on this page are performed in the Google Cloud console because Google BigQuery is a Google Cloud product.
• You must set up billing for your Google Cloud project because there is a cost to query and store your Drive inventory exports in BigQuery. For details, review your billing account’s pricing details for BigQuery. You can estimate your storage costs with the Google Cloud Pricing Calculator. The metadata for 1 million files uses about 1.5 GB physical storage in BigQuery.
• You need to have a supported license to set up Drive inventory report exports, but the report includes data for all your users.
• Your Drive inventory is exported weekly, but may be exported more frequently. The export overwrites the previous export. To preserve previous exports, use the BigQuery Data Transfer Service to automatically copy the dataset.
• There’s a small chance that a Drive inventory export might be missing file metadata for some files. In rare cases, some files might not be included.

Step 1. Set up a BigQuery project & dataset for your Drive inventory

1. In the Google Cloud console, create or open an active BigQuery project.
   For details, go to Creating and managing projects.
2. Enable billing for the project if it isn’t already.
3. Go to the IAM page for the project.
4. Give Google Workspace administrator accounts access to the export for data processing and viewing. Learn more about BigQuery IAM roles and permissions and how to control access to resources. For any Google Workspace accounts you want to give access to the export:
   1. At the top of the list of principals, click Grant Access.
   2. In Add principals, enter the Google Workspace account's email address.
   3. Click the the BigQuery Editor (bigquery.dataEditor) role. Tip: Click Filter and enter BigQuery to find other BigQuery-specific roles.
   4. Click Save.
5. Give yourself and any other administrator who will manage Drive inventory exports the IAM administrator permission on the project:
   1. On the same IAM page, click an existing principal or start a new principal as in the previous step.
   2. Click the Resource Manager role and select Project IAM Admin.
   3. Click Save.
6. Find or create a BigQuery dataset to store your Drive inventory exports.
   1. Click Navigation menuBigQuery.
   2. In the Explorer panel at the left, expand your project to list existing datasets.
   3. If there’s a dataset you want to use, make a note of the ID to use in the next step.
   4. If you want to use a new dataset, go to Creating datasets. Make a note of the dataset name to use in the next step.

Step 2. Turn on and set up Drive inventory exports

1. Sign in with a super administrator account to the Google Admin console.

   If you aren’t using a super administrator account, you can’t complete these steps.

2. Go to Menu  Reporting > Data integrations.

   Requires having the Reports administrator privilege.

   Education administrators go to Menu ReportingBigQuery export, which opens the Data integrations page.

3. Click Drive Inventory Exports.
4. Check the box to enable Drive inventory exports.
5. Under BigQuery project ID, select the project where you want to store the Drive inventory export. If you don’t see the project, you need to set it up in BigQuery. For details, go to Quickstart using the Google Cloud console.
6. Under Existing dataset within the project, enter the name of the dataset to use for storing the Drive inventory in the project. If you don’t have a dataset already, go to Creating datasets for steps.
7. Click Save. If you get an error that you can’t save, check for the following issues in Google Cloud Console:
   1. Go to the IAM page for your project and make sure your account has the Project IAM Admin role (resourcemanager.projects.setIamPolicy). If not, grant that role for your account.
   2. Go to the Policy Troubleshooter and check if any deny policies are blocking your access to the project. For details, go to Troubleshoot policies.

After enabling the exports, you should see the first export appear in BigQuery in 1–2 weeks. After that, the export is updated weekly, but may be exported more frequently.

Step 3. (Optional) Update the data expiration time

The default expiration for data exports is 60 days, after which the data is deleted from Google Cloud.

To change the expiration time, go to Updating default table expiration times.

Step 4. Monitor exports and set up alerts for failures

Drive inventory export events are included in Admin log events. In the security investigation tool, you can search for the Drive inventory export-related events and set up alerts.

Step 5. Analyze Drive inventory datasets

You can analyze your data directly in BigQuery. For an overview, go to Overview of BigQuery analytics | Google Cloud. For details, go to Schema and example queries for Drive inventory exports in BigQuery.

Troubleshoot missing exports and error messages

If you don’t see Drive inventory exports in BigQuery after you save your configuration in the Admin console, review the following issues and how to resolve them.

Known limitations

• Drive inventory exports may not include unclaimed Jamboard files or videos created with Google Vids.

FAQ

Expand all  |  Collapse all & go to top