Search
Clear search
Close search
Google apps
Main menu
true

Set file-sharing permissions for organizations

As a G Suite administrator, you can control how users in your organization share Google Drive files and folders. This includes Google Docs, Sheets, Slides, My Maps, folders, and any other items stored on Drive. When users share folders, all of the folder contents usually get shared as well. 

This article is for administrators. To learn how to share your own files, go to Share files from Google Drive.

Before you begin (optional)

If you want to set permissions by department or domain

This information applies to G Suite Enterprise, Business, Education, and Nonprofits editions. Compare editions.

File owners can share their files based on the permissions you set for their organizational units:

  1. Add an organizational unit for each department or domain. For steps, see Add an organizational unit.
  2. Move users to your organizational units. For steps, see Move users to an organizational unit. 
  3. Set sharing permissions for each organizational unit using the instructions below.

If file owners move to different organizational units, or if file ownership transfers to someone in a different organizational unit, the file's sharing permissions change to those of the new organizational unit.

Users can never share files they don’t own beyond what is allowed for the file owners. This is true even if users are in organizational units with more permissive sharing settings.

Set sharing permissions

Let users share with anyone
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. If you have the G Suite Enterprise, Business, Education, or Nonprofits edition, select the desired organizational unit. (Compare G Suite editions.) Otherwise, your settings apply to your entire organization.

  5. Under Sharing outside your organization, turn file sharing on, and choose sharing options:

    Option Description
    On Lets users invite people outside your organization to view, comment on, or edit shared files.
    For files owned by users in your organization, warn when sharing outside your organization
     
    (Optional) Alerts users to make sure files aren't confidential before they share them outside your organization.
    Allow users in your organization to send sharing invitations to people outside your organization who are not using a Google account (Optional) Lets users share files with people outside your organization who don't use Google accounts. If you uncheck this box, users can share files with outside recipients only if those recipients use Google accounts or are on a Google Groups mailing list.

    Note: Google accounts don’t have to use Gmail or G Suite addresses. A Google account is simply a unified sign-in system that provides access to Google products, including Docs, Sheets, and Slides. If someone doesn’t have a Google account, send them this link: https://accounts.google.com/signupwithoutgmail.

    • Require Google sign-in for external users to view file. Requires recipients to sign in to Google accounts before opening files. That is, unless files are shared publicly on the web or available to anyone with links, if you allow that.
    • Allow external users to preview file without Google sign-in. Lets recipients preview file contents in a read-only mode without signing in to Google accounts.

    To edit or comment on files, reviewers must sign in to Google accounts, and invitations must allow commenting or editing.

    Allow users in your organization to publish files on the web or make them visible to the world as public or unlisted files

    (Optional) Lets users:

    • Publish Docs, Sheets, and Slides via File and then  Publish to the Web. This makes files accessible and searchable to anyone on the web. 
    • Select sharing settings that make files visible to the world as either public or unlisted files. Learn more about who links can be shared with.

    If you uncheck this box, users can still send file-sharing invitations to anyone. They just can't make files public on the web. 

    This setting is not available in the legacy free edition of G Suite. All free edition users can publish files on the web or share the link with anyone.

  6. Click Save.

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

Restrict sharing outside whitelisted domains

This feature is available with G Suite Enterprise, Business, Education, and Nonprofits editions. Compare editions.

You can restrict file sharing to trusted (whitelisted) G Suite domains only. This keeps users from sharing files outside your organization. But it allows them to share files with business associates on other G Suite domains.

To be whitelisted, domains must be G Suite domains.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. If you have the G Suite Enterprise, Business, Education, or Nonprofits edition, select the desired organizational unit. (Compare G Suite editions.) Otherwise, your settings apply to your entire organization.

  5. Under Sharing outside your organization, choose sharing options:
    Option Description
    Whitelisted Domains

    Allows users in the specified organizational unit to share files with people in external whitelisted G Suite domains. In addition, users who are signed in to whitelisted domains can access Google Forms that were created in the organizational unit and that have Require login to view this form selected.

    For files owned by users in your organization, warn when sharing with users in whitelisted domains
     
    (Optional) Alerts users to make sure files aren't confidential before they share them with whitelisted domains.
    Allow users in your organization to receive files from users outside of whitelisted domains (Optional) Enables users to open files that are shared with them by people in domains that aren't on the whitelist. If you uncheck this box, users can open files only if they are shared by people in domains on the whitelist.
     
  6. Click Save.
  7. Add trusted G Suite domains to the whitelist. The whitelist is automatically available to all organizational units in your organization.

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

Restrict sharing outside your organization

You can restrict users from sharing or receiving the following items outside your organization:

  • Invitations to Docs, Sheets, and Slides, which can be used for 14 days after they are created 
  • Links to files stored in Drive
  • Email attachments that can be sent or received by users, uploaded directly from devices, and stored in Drive
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. If you have the G Suite Enterprise, Business, Education, or Nonprofits edition, select the desired organizational unit. (Compare G Suite editions.) Otherwise, your settings apply to your entire organization.

  5. Under Sharing outside of your organization, turn sharing off, and select options: 
    Option Description
    Off Prevents users from sharing Google Drive files with people outside your organization through invitations, links, and email attachments.
     
    Allow users in your organization to receive files from users outside of your organization (Optional) Prevents users from opening files shared from outside organizations. If you check this box, users can open files shared from outside your organization, but they can share within your organization only.
     
  6. Click Save.

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

Control files stored on Team Drives

This feature is available with G Suite Enterprise, Business, Education, and Nonprofits editions. Compare editions.

You can control whether users can move files and folders that are stored on Team Drives to locations outside your organization. 

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. If you have the G Suite Enterprise, Business, Education, or Nonprofits edition, select the desired organizational unit. (Compare G Suite editions.) Otherwise, your settings apply to your entire organization.

  5. In Moving content outside of your organization, select an option:
    Option Description
    Anyone Anyone with full access to a Team Drive can move files and folders from that Drive to a Drive location in a different organization. Learn about user access permissions.
     
    Only users in your organization Only people in your organization with full access can move files and folders from a Team Drive to a Drive location in a different organization.
     
    No one Files and folders on a Team Drive can’t be moved to a Drive location in a different organization.
     
  6. Click Save

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

 

Control Team Drive creation

You can control whether users can create Team Drives in your organization. For instructions, see Manage your Team Drives users and activity.

Set Access Checker options & the link-sharing default

Choose Access Checker options

When users share files through G Suite tools, Access Checker verifies that recipients have access to files. The service also prompts users to give access if necessary. This happens when users:

  • Send Gmail messages with links to files that haven't been shared with recipients.
  • “+” someone into a comment on a doc who doesn't have access to the doc.
  • Attach files to calendar events where guests don't have access to the files.

If users share files they don't own, Access Checker options come from the file owner's organizational unit. If users share multiple files, and different organizational unit settings apply, Access Checker options come from the least permissive organizational unit.

As an administrator, you can specify the level of access users can give.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. If you have the G Suite Enterprise, Business, Education, or Nonprofits edition, select the desired organizational unit. (Compare G Suite editions.) Otherwise, your settings apply to your entire organization.

  5. Click Sharing settings
  6. Under Access Checker, select how you want users to resolve file-access issues: 
    Option Description
    Recipients only, your organization, or public (no Google account required)

    Gives users 3 options:

    • Give access to required recipients.*
    • Give access to everyone in your organization who has the link.
    • Make the file public (available to anyone who has the link).

    This setting is available only if sharing is turned on for your organization, and you allow users to publish files on the web.

    Recipients only or your organization

    Gives users 2 options:

    • Give access to required recipients.*
    • Give access to everyone in your organization who has the link.
    Recipients only Lets users give access to required recipients.* 
     

    * Giving access to required recipients simply adds recipients to the sharing list. If the file has been shared with other people, they still have access.
     
  7. Click Save

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

Set the default for link sharing

You can set the link-sharing option that appears by default when users share files. Users can choose different options unless you restrict file sharing.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. If you have the G Suite Enterprise, Business, Education, or Nonprofits edition, select the desired organizational unit. (Compare G Suite editions.) Otherwise, your settings apply to your entire organization.

  5. Under Link Sharing, select the default option for new files created by your users:
    Option Description
    Off Gives access to the owner and people the owner has shared the file with.
     
    On - Anyone at your organization with the link Gives access to anyone in your organization who has the link. Files with this visibility don’t normally appear in search results unless there are links to them from other files that are searchable.
     
    On - Anyone at your organization Lets anyone in your organization search for and view files. However, files appear in users’ Drives only after users have accessed files or after files have been shared with them.
     
  6. Click Save.

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

Verify changes

It's best to wait 24 hours before you test any changes to sharing settings. During this time, both old and new settings might be intermittently enforced.

Was this article helpful?
How can we improve it?
Sign in to your account

Get account-specific help by signing in with your G Suite account email address, or learn how to get started with G Suite.