tenant-audit-v1.6.2

Shared drives are now scanned as one of their own active members, managers first. The audit no longer has to add the admin to each drive, and it works when the audit admin holds no Workspace licence. A new shareddrive.scannedAs column says whose view each drive was read through. A member whose Drive is switched off is skipped for the next member, instead of the drive being reported as empty and clean. A scan sees what that member sees, so a limited-access folder they are kept out of is not covered.

--grant-temp-access is now only a fallback for a drive that none of its members can list. If Google refuses the grant, the report gives Google's reason. Resuming a run re-scans any shared drive left unscanned, and the My Drive scan limit is now 4 hours instead of 1.

Admin accounts with app passwords are rated High instead of Critical. An app password cannot sign in to the Admin console, but it lets a mail, calendar or contacts app reach the mailbox without 2-step verification. Files shared to a target audience are no longer reported as shared with an external domain.

Tested on Linux, macOS and Windows.