How to audit and remove Google Calendar sharing in Google Workspace

You audit Google Calendar sharing in two places, and they answer different questions. The Google Admin console’s Calendar log events report shows sharing changes. Logs do not give you a complete current access inventory. To know who has access now, list each calendar’s ACLs through the Google Calendar API, GAM, or a specialist tool.

There’s no bulk remove button either. Stripping access means one calendar at a time, or a script.

Why this is worth an afternoon

Meeting titles carry deal names, candidate names, legal matters and layoff dates. Access, once granted, stays granted, because nobody sends a reminder to unshare. And Calendar has never had a “who has access” report, which is why the log gets mistaken for one.

The three layers where Calendar sharing lives

Admins check only the first.

1. The org-wide ceiling, at Menu > Apps > Google Workspace > Calendar > Sharing settings. Google documents three internal options for primary calendars: “No sharing,” “Only free/busy information (hide event details),” and “Share all information.” External sharing runs up to “Share all information, and allow managing of calendars.”
2. Per-calendar access rules. Every grant your users made, invisible to the Admin console.
3. Rooms and resources. Booked and shared independently, rarely reviewed.

Layer one narrows what people can grant next week. It says nothing about who already has access.

How to see who has access to a Google Calendar right now

List the access control rules on the calendar itself. The Google Calendar API’s Acl resource supports list, insert, patch, update and delete, with roles from freeBusyReader to owner, so Acl: list returns the live grants. GAM wraps the same calls; specialist platforms do it with a UI.

The log can’t answer this. A calendar shared in 2019 and never touched since generates no recent event, so it’s invisible there while the access is still live.

Dump the results into a table you can diff month to month:

Field	What it holds
Calendar ID	The calendar the rule sits on
Owner	The user or resource that owns it
Grantee email	Who holds the access
Role	freeBusyReader, reader, writer, owner
Scope type	user, group, domain or default
Created or last changed	From the audit log, when it falls inside the window
Action	Keep, downgrade or remove

The last column is the point. An inventory nobody acts on is just a spreadsheet.

How to read the Calendar audit log

Use the log for what changed, not for what exists.

1. Open Reporting > Audit and investigation > Calendar log events.
2. Filter on change_calendar_acls, which the Reports API documents as “Calendar access level(s) changed.”
3. Read the parameters: grantee_email, access_level (editor, freebusy, none, owner, read, root), calendar_id and api_kind.
4. Check the clock. Google lists Calendar log events at 6 months, lag “Tens of minutes (can also go up to a couple of hours).”

On Frontline, Enterprise and Education Standard or Plus, Enterprise Essentials Plus, or Cloud Identity Premium, the security investigation tool queries the same data with more filters. It’s edition-gated, so check yours before planning around it.

How to remove Google Calendar sharing

Honest answer: the Google Admin console has no bulk unshare.

Method	Scope	Who runs it
Calendar settings	One calendar at a time	The owner
Calendar API Acl: delete	Scriptable, domain-wide	A developer with delegation
GAM	Scriptable, domain-wide	An admin in a terminal
Third-party platform	Bulk, with a UI	Any admin

Acl: delete is the route at scale, driven off that inventory.

Credit where it’s due: GAT Labs is strong here. GAT+ audits calendars and their ACLs domain-wide, and GAT Labs documents GAT Flow as able to “Automatically remove calendar (reader, writer, free/busy reader) permissions from any given user(s).”

Where people get this wrong

Auditing the setting instead of the state. Sharing settings tells you what’s allowed, nothing about grants already in place. Two questions, and only one is a risk.

Forgetting the leaver’s calendar. Three things linger: calendars they shared, calendars shared with them, and recurring meetings and room bookings with a ghost as organizer. Suspension unpicks none of it. Patronum handles it in an offboarding policy, documented as transferring a user’s Google Calendar “to an Executor, Delete Events, and also remove user as an attendee.”

Can my boss see my private Google Calendar events?

It depends on their access, so don’t treat Private as a guarantee. Google Calendar Help says Private “restricts visibility to people that can make changes to events on your calendar.” That’s the catch. Anyone holding “Make changes to events” on your calendar, a manager or assistant you granted it to years ago included, can “find and change any details. This includes private events or tasks.” No Admin console screen shows event descriptions, and Google’s Reports API appendix lists no parameter carrying the event title. Admin-level capabilities can still reach the content another way: Calendar is a Google Vault supported service for retention, holds and export, so an admin with Vault privileges can export your events. Private hides details from ordinary viewers, not from high-privilege access.

Frequently asked questions

How do I see who has access to a Google Calendar in Google Workspace?

Call Acl: list on the calendar through the Google Calendar API, or use GAM or a specialist tool. That’s the only complete current list. The Admin console’s Calendar log events report shows changes from the last six months, not who has access today.

Can an admin remove Google Calendar sharing in bulk?

Not from the Admin console. Google provides no bulk unshare for Calendar. Use Acl: delete via the Calendar API, GAM, or a platform such as GAT Labs or Patronum.

How long does Google keep Calendar audit logs?

Six months. Google’s data retention and lag times page lists Calendar log events at 6 months, with a lag of tens of minutes, sometimes a couple of hours. It’s a rolling window, not a history.

What happens to a departing employee’s shared calendars?

Nothing, unless you act. Suspending the account leaves calendars they shared, calendars shared with them, and their room bookings in place. Transfer to an executor, then clear future events.

Make the cleanup part of the process

Calendar sharing is easier to prevent than to unwind. Patronum runs the calendar handover, group removal and file permission cleanup as one offboarding policy, and Patronum Archive takes the mailbox off the license bill without deleting the mail. See the offboarding checklist and GAT Labs alternatives.

Sources

• Google Admin Help: Calendar sharing – sharing levels
• Google Admin Help: Calendar log events – path, editions
• Google Admin SDK: Calendar audit events – change_calendar_acls
• Google Admin Help: Data retention – 6 months
• Google Calendar API: Acl resource – methods, roles, scope
• Google Calendar Help: Visibility – Private
• Google Vault Help: Supported services – Calendar
• GAT Labs: Auditing Google Calendars – GAT Flow
• Patronum: Offboarding policy – calendar transfer