Restrict public Drive exposure
Review publicly accessible and link-editable files, confirm their business purpose, and remove access that is no longer required.
Illustrative sample report
Technical evidence, shaped for an executive decision.
This public report uses a fictional ACME GmbH tenant and deliberately synthetic data. It demonstrates the structure of a TenantOne assessment; it does not describe a customer, a real domain or a live scan.
Synthetic dataFictional ACME GmbH example
tenantone.io/report/acme-gmbh-sample
TenantOneSample dataGoogle Workspace Health Assessment
- Tenant
- acme-gmbh.example
- Scan date
- 12 Jul 2026
- Users in scope
- 40
- Checks run
- 64
68
High risk
Synthetic demonstration tenant
- 2-Step Verification enforced for all admins
- SPF, DKIM and DMARC records configured
- Publicly accessible Drive files
- High-risk Chrome extensions detected
- Shared Drives have active managers
Executive summary
68
High risk
Weighted score out of 100
Management view
Material exposure is concentrated in sharing, email controls and third-party access.
In this fictional 79-check assessment, the recommended response is to contain public data exposure first, validate privileged access, and then convert inactive accounts and stale storage into an approved savings plan.
Risk scores prioritize attention; they are not a guarantee of compromise or a substitute for professional judgment.
Illustrative area risk scores — higher means more urgent
45 / 100
Identity risk
Administrator exposure, account lifecycle and 2-Step Verification.
72 / 100
Security risk
Email controls, third-party access and security events.
64 / 100
Collaboration risk
Groups, external sharing, Drive and Shared Drives.
37 / 100
Storage & license risk
Inactive seats, storage pressure and archival potential.
Key metrics
The operating context behind the score.
Metrics make findings easier to size, assign and discuss. Every value below is invented for the ACME GmbH sample.
Users
40 total / 39 active
Inactive accounts
8 over 30 days / 6 over 90 days
Reclaimable seats
7 potential
Storage in use
1.1 TB
Third-party apps
6 with tenant access
Open findings
2 critical / 9 high
Estimated annual savings
€1,836 in modeled opportunity.
The sample combines potentially reclaimable licenses and archivable storage. It is an estimate, not a quote or a guaranteed saving.
License opportunity
€966 / year
7 potential seats × €11.50 monthly assumption × 12 months.
Storage opportunity
€870 / year
Illustrative archival volume and customer-supplied storage cost.
- Validate account ownership, retention obligations and license terms before removal.
- Confirm that archival remains accessible, governed and recoverable.
- Treat modeled savings as a decision input, not a financial commitment.
Prioritized response
A short action plan before the full findings register.
Top actions are ranked from finding severity and affected scope so leadership can align owners and sequence remediation.
Review high-risk OAuth grants
Validate applications with broad Drive or Gmail access and revoke grants that do not have a current owner or approved use case.
Enforce stronger email authentication
Move from monitoring to an enforcement plan for DMARC after validating legitimate senders and DKIM coverage.
Reclaim inactive licenses
Confirm account owners, preserve required data, and remove paid seats only after the organization approves the lifecycle decision.
Close browser visibility gaps
Enroll managed Chrome profiles and review high-risk extensions before treating browser coverage as complete.
Sample findings
Evidence stays attached to every recommendation.
A report separates observed evidence from the remediation decision, giving administrators a practical starting point for validation.
Critical
Publicly accessible Drive files
12 files are visible without an authenticated organizational account.
Suggested response: Validate ownership and remove public access where it is not explicitly required.
High
DMARC enforcement is missing
The sample domain has no enforceable DMARC policy in its public DNS.
Suggested response: Inventory legitimate senders, enable reporting, then progress toward enforcement.
High
Broad third-party application access
Three grants include broad Drive, Gmail or contact permissions.
Suggested response: Confirm business ownership and revoke applications that are not approved.
Passed
2-Step Verification for administrators
All six synthetic super administrators are enrolled in 2-Step Verification.
Suggested response: Retain monitoring and review administrator count and role necessity.
Framework context, not certification.
TenantOne maps relevant check categories at framework level to CIS Google Workspace guidance, GDPR, ISO 27001 and NIS2. This mapping helps organize evidence and identify topics for review. It is not a control audit, legal opinion, conformity assessment, certification, or proof that an organization complies with any framework. Applicability and compliance remain the organization's responsibility.
Start with evidence
Explore the assessment with synthetic data.
Create an account and open the demo tenant before connecting Google Workspace. The demo is designed to show the report, findings and evidence flow without using customer data.