Manage external sharing for your organization

This article is for administrators. To learn how to share or set permissions for your own files, go to Share files from Google Drive.

As an administrator, you can control if users can share Google Drive files and folders with people outside your organization who have Google Accounts. These sharing settings apply to items from Google Docs, Sheets, Slides, Sites project files, My Maps, folders, and anything else stored in Drive.

Depending on your Google Workspace edition, you can:

• turn external sharing on or off for your entire organization
• turn external sharing on or off for specific child organizational units or configuration groups
• allow sharing only with certain domains
• restrict link sharing when external sharing is turned on
• restrict external user access to content in shared drives

Note:

• If you need more granular control over sharing, you can use trust rules to manage sharing both outside and inside your organization. For instructions, see Create and manage trust rules for Drive sharing.
• To control sharing with external non-Google users, turn visitor sharing on or off.

Example sharing setting scenarios

Expand all  |  Collapse all

Turn on or off external sharing of files and folders in Drive

Sharing content in Drive with people outside your organization can be an important collaboration process, but it also carries risk of data leaks. If you turn on external sharing, you have options to limit sharing, such as warning users before they share or preventing link sharing.

If you turn off external sharing, users can’t share the following items with external users:

• Invitations to items created in Docs, Sheets, and Slides
• Links to files stored in Drive
• Items attached to emails, either uploaded directly from devices or stored in Drive

You can also block these same items coming from external users to users in your organization. These restrictions apply to external group members. When files are shared with a group that has external users, those external users can’t access the file.

To turn external sharing on or off:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle WorkspaceDrive and Docs.

3. Click Sharing settings > Sharing options.

4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.
5. To turn on external sharing:
   1. In the Sharing outside of your organization section, click On and choose sharing options.
   2. To warn users when they try to share externally, check the Warn when files owned by users or shared drives in your organization are shared outside of your organization box.
   3. To allow users to share content with people who don’t use Google Accounts, check the Allow users or shared drives in your organization to share items with people outside your organization who aren't using a Google account box.

      Note: To edit or comment on files, users must sign in to a Google Account (or a visitor account if you have visitor sharing turned on)

   4. To allow link sharing (when anyone with the link can access the file), check When sharing outside of your organization is allowed, users in your organization can make files and published web content visible to anyone with the link.
6. To turn off external sharing:
   1. In the Sharing outside of your organization section, click Off.
   2. To also prevent external content being shared with your users, including content in third-party storage systems, uncheck Allow users in your organization to receive files from users outside of your organization.
7. Click Save. If you configured an organizational unit or group, you might be able to either Inherit or Override a parent organizational unit, or Unset a group.

Allow external sharing with only certain domains

You can allow file sharing with only trusted (allowed) domains. When you use an allowlist to restrict sharing:

• The domain must be a Google Workspace domain unless you’re using visitor sharing.
• You can’t select only certain domains in the allowlist for file sharing. All trusted domains are included.
• Users can’t share files with personal accounts.
• If your organization has a mix of Cloud Identity and Google Workspace licenses, domains allowed for Google Workspace users also apply to Cloud Identity users.

If you haven’t already, add trusted domains to your allowlist.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle WorkspaceDrive and Docs.
3. Click Sharing settingsSharing options.
4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.
5. In the Sharing outside of your organization section, click Allowlisted Domains and choose sharing options:
   1. To warn users when they try to share with users in a trusted domain, check the Warn when files owned by users or shared drives in your organization are shared outside of your organization box.
   2. To allow users to open files from domains that aren’t on an allowlist and edit Google Docs, Sheets, Slides, and Sites stored on third-party storage systems, check Allow users in your organization to receive files from users outside of allowlisted domains.
   3. To allow PIN-verified visitor sharing with non-Google users in trusted domains, check the Allow users or shared drives in your organization to share items with people outside your organization who aren't using a Google account box.
6. Click Save. If you configured an organizational unit or group, you might be able to either Inherit or Override a parent organizational unit, or Unset a group.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Control who can move content to a shared drive owned by another organization

You can control who can move files and folders outside of your organization when moving content from:

• A shared drive in your organization to a shared drive owned by another organization or someone’s My Drive in another organization
• A My Drive in your organization to a shared drive owned by another organization

For details on controlling who can access files stored on shared drives, go to Control sharing for your organization.

Related topics

• Set general access options for file sharing in Drive
• Restrict the access users can give to files