Get started: Drive setup guide for admins

Set Drive users' sharing permissions

This article is for administrators. To learn how to share your own files, or set permissions for your own files, go to Share files from Google Drive.

As an administrator, you can control how users in your organization share Google Drive files and folders. These items include Google Docs, Sheets, Slides, My Maps, folders, and any other items stored in Drive. When users share folders, they usually share folder contents as well.

Before you begin (optional)

Set permissions by organizational unit or group

Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Essentials.  Compare your edition

File owners can share their files based on the permissions you set for their organizational unit or group. Typically, you choose permissions for organizational units or your domain. Then you can customize permissions for groups of users within or across organizational units.

  1. Add an organizational unit for each department or domain. For steps, go to Add an organizational unit.
  2. Move users to your organizational units. For steps, go to Move users to an organizational unit.
  3. Set sharing permissions for each organizational unit using the instructions below.

Set sharing permission for groups

If file owners move or ownership transfers to someone in a different organizational unit or group, the file's sharing permissions change to those of the new organizational unit or group. Also, reordering the priority of groups can change a file owner's sharing permissions. Learn to Customize service settings with configuration groups.

Users can’t share files they don’t own beyond what is allowed for the file owners. This is true even if users are in organizational units or groups with more permissive sharing settings.

Step 1: Set sharing permissions

Open all   |   Close all

Let users in your organization share with anyone

You can let users invite people outside your organization to access shared files. You can also let them make files public on the web.

Cloud Identity customers: If every one of your users has a Cloud Identity license, they can always share files with users outside your organization and publish files on the web for anyone to access.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Appsand thenGoogle Workspaceand thenDrive and Docs.
  3. Click Sharing settingsand thenSharing options.
  4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

    Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials.  Compare your edition

  5. For Sharing outside of your organization, click On and choose sharing options:
    • Warn when sharing outside of your organization—To protect confidentiality, warnings display in Docs editor or Drive sharing dialogs when users share files outside your organization.
    • Send sharing invitations to people outside your organization who are not using a Google Account—Users can share files with people who don’t use Google Accounts. However, to edit or comment on files, users must sign in to a Google Account (or a visitor account if you have visitor sharing turned on).
    • Allow users to publish files on the web or make them visible as public or unlisted files—Users can:
      • Make files accessible and searchable to anyone on the web. Learn more
      • Select sharing settings that make files visible to the world as public or unlisted files. Learn more
  6. Click Save.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Restrict sharing outside of allowed domains

Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Essentials.  Compare your edition

You can restrict file sharing to trusted (allowed) domains only. When you use an allowlist to restrict sharing:

  • The domain must be a Google Workspace domain unless you’re using visitor sharing. For details, go to Allow sharing to non-Google accounts.
  • Users can’t share files with personal (Gmail) accounts.
  • If your organization has a mix of Cloud Identity and Google Workspace licenses, domains on an allowlist configuration for Google Workspace users also apply to users with Cloud Identity licenses.

To restrict sharing to domains on an allowlist:

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Appsand thenGoogle Workspaceand thenDrive and Docs.
  3. Click Sharing settingsand thenSharing options.
  4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

    Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials.  Compare your edition

  5. For Sharing outside of your organization, click Whitelisted Domains and choose sharing options:
    • Warn when sharing with users in whitelisted domains—To protect confidentiality, warnings display in Docs editor or Drive sharing dialogs when users share files with users in a domain on an allowlist.
    • Allow users to receive files from users outside of whitelisted domains—Users can:
      • Open files from domains that aren’t on an allowlist.
      • Use Docs editors to edit Google Docs, Sheets, and Slides stored on third-party storage systems, such as Box. Learn more
    • Allow users to send sharing invitations to people who are not using a Google Account—Allows PIN-verified sharing to non-Google users in domains on your allowlist. Learn more
  6. Click Save.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Next step: Add trusted domains to your allowlist

For details, go to Allow external sharing with only trusted domains.

Restrict sharing outside your organization

Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Essentials.  Compare your edition

You can restrict users from sharing or receiving the following items outside your organization:

  • Invitations to Docs, Sheets, and Slides, which are active for 14 days
  • Links to files stored in Drive
  • Email attachments that users can send or receive, uploaded directly from devices and stored in Drive
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Appsand thenGoogle Workspaceand thenDrive and Docs.
  3. Click Sharing settingsand thenSharing options.
  4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

    Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials.  Compare your edition

  5. For Sharing outside of your organization, click Off.
  6. (Optional) To keep users from opening or editing files from domains not on your allowlist or in third-party storage systems, uncheck the box to Allow users in your organization to receive files from outside users.
    Note: If you set a policy that restricts external users from accessing your organization’s information, users can share files with a group that has external users, but those users can’t access the files.
  7. Click Save.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Control files stored on shared drives

Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Essentials.  Compare your edition

You can control who can move files and folders outside of your organization when moving content from:

  • A shared drive in your organization to: 
    • A shared drive owned by another organization
    • Someone’s My Drive in another organization
  • Someone’s My Drive in your organization to a shared drive owned by another organization 
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Appsand thenGoogle Workspaceand thenDrive and Docs.
  3. Click Sharing settingsand thenSharing options.
  4. Select the desired organizational unit or group
  5. In Distributing content outside of your organization, select an option:
    • Anyone
      • People with Manager access to a shared drive can move files from that shared drive to a Drive location in a different organization. Learn more
      • People in the selected organizational unit or group can move content from their My Drive to a shared drive owned by a different organization (for example, another business, group, or school). Learn more
    • Only users in your organization
      • People with Manager access to a shared drive can move files from that shared drive to a Drive location in a different organization.
      • Users in the selected organizational unit or group can move content from their My Drive to a shared drive owned by a different organization.
    • No one
      • Files on a shared drive cannot be moved to a Drive location in a different organization.
      • No one in the selected organizational unit or group can move content from My Drive to a shared drive owned by a different organization.
      • No one in the selected organizational unit or group can create files on a shared drive owned by another organization.
  6. Click Save.

Important: If you select a child organizational unit or group, this setting only controls moving content from someone’s My Drive to a shared drive in a different organization (for example, another business or school). Settings at the top-level organizational unit, which owns shared drives, always controls content moving from a shared drive to another organization.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Control shared drive creation

You can control whether users can create shared drives in your organization. For details, go to Allow users to create shared drives.

Allow users to share files publicly
Here are quick steps any user can take to make a file public to anyone:
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Appsand thenGoogle Workspaceand thenDrive and Docs.
  3. Click Sharing settingsand thenSharing options.
  4. For Sharing outside of your organization, click On.
    Note: This setting applies to files in shared drives as well.
  5. Check the following boxes:
    • For files owned by users in your organization warn when sharing outside of your organization
    • Allow users in your organization to send sharing invitations to people outside your organization who are not using a Google account
    • Allow users in your organization to publish files on the web or make them visible to the world as public or unlisted files
  6. Click Save.
It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Step 2: Set link sharing & Access Checker options

Choose Access Checker options

When users share files through Google Workspace tools, Access Checker verifies that recipients have access to files. The service also prompts users to give access if necessary. This happens when users:

  • Send Gmail or Google Chat messages with links to files that haven't been shared with recipients.
  • +mention someone in a comment in a doc who doesn't have access to the doc.
  • Attach files to calendar events where guests don't have access to the files.

If users share files they don't own, Access Checker options come from the file owner's organizational unit. If users share multiple files and different organizational unit settings apply, Access Checker options come from the least permissive organizational unit.

As an administrator, you can specify the level of access users can give.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Appsand thenGoogle Workspaceand thenDrive and Docs.
  3. Click Sharing settings.
  4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

    Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials.  Compare your edition

  5. Click Sharing options.
  6. For Access Checker, specify how you want users to resolve file-access issues:
    • Recipients only—Users can only give access to required recipients.* This is the most restrictive setting.
    • Recipients only or suggested target audience—Users can give access to:
      • Required recipients*
      • One or more groups of users set as a target audience. By default, the primary target audience is everyone in your organization who has the link. You can set a different primary target audience.
    • Recipients only, suggested target audience, or public—Users can give access to:
      • Required recipients*
      • One or more groups of users set as a target audience. By default, the primary target audience is everyone in your organization who has the link. You can set a different primary target audience.
      • The public (available to anyone who has the link)
        This is the least restrictive setting. It’s available only if sharing is turned on for your organization and you allow users to publish files on the web.

        * Giving access to required recipients simply adds recipients to the sharing list. If the file has been shared with other people, they still have access.

  7. Click Save.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Set the default for link sharing

You can set the default link-sharing option users get when they share files from Docs. This default applies when sharing files in My Drive, but not in shared drives. Users can use this default or choose a different option for sharing their files.

To prevent users from choosing a different sharing option, refer to the section above: Restrict sharing outside of allowed domains.

Cloud Identity customers: If your organization has a mix of Cloud Identity and Google Workspace licenses, the link-sharing setting for the Google Workspace users also applies to the users with Cloud Identity licenses.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Appsand thenGoogle Workspaceand thenDrive and Docs.
  3. Click Sharing settings.
  4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

    Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials.  Compare your edition

  5. Click Link Sharing.
  6. Select the default sharing option for display in the link-sharing dialog when users share files:
    • Off—Only the file owner and people the owner has shared the file with can access the file.
    • On - Primary target audience with the link—Anyone in your primary target audience who has the link can access the file. Files with this visibility don’t normally appear in search results unless there are links to them from other files that are searchable.
    • On - Primary target audience—Anyone in your primary target audience can search for and view the file. However, a file with this visibility appears in a user’s Drive only after they access the file or the file is shared with them.

    Important: By default, the primary target audience is everyone in your organization (named your organization). You can set a different primary target audience.

  7. Click Save.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Set target audiences

Supported editions for this feature: Business Standard and Plus; Enterprise; Education Standard and Plus; G Suite Business.  Compare your edition

Use target audiences to recommend which groups of people users should share with, such as departments or teams. Learn more about target audiences.

If you turn on link sharing, the predefined default—or primary—target audience is named your organization. This audience includes all users in your organization. If your organization has created additional target audiences, you can:

  • Apply target audiences to Drive.
  • Set a different primary target audience for all or just specific users.
  • Remove target audiences from Drive.

Before you begin: You can set target audiences for your top-level organizational unit, a child organizational unit, or a configuration group. However, note that files in shared drives always show the target audiences set for your top-level organizational unit.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Appsand thenGoogle Workspaceand thenDrive and Docs.
  3. Click Sharing settingsand thenTarget audiences.
    The Audiences list shows any target audiences that are already applied to the service, in the order they appear in users' sharing settings.
  4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

    Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials.  Compare your edition

  5. (Optional) To add one or more audiences:

    1. Click Add target audiences.
    2. Choose an option:
      • Check the box for up to 5 target audiences you want to apply to the service.
      • Search for an audience by entering the first few letters of its name.

  6. (Optional) To remove a target audience, next to the audience, click Remove"".

    Click the X icon to remove a target audience

  7. (Optional) To change the order that target audiences appear in users' link-sharing settings, choose an option:
    • Drag the audience to a new position.
      Drag a target audience to the Primary position
    • Enter the order in which you want it to appear in the box to the left of the audience's name.

      Note: The first position is the primary (default) target audience, which appears first in a user's list of sharing recommendations.

  8. Click Save.

Important: To make the primary target audience appear as the default link-sharing option to users, make sure link sharing is turned on.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Step 3: Verify changes

Wait 24 hours before you test changes to sharing settings. During this time, old and new settings might be intermittently enforced.

Related topics


Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

Search
Clear search
Close search
Google apps
Main menu
Search Help Center
true
73010
false