Set file-sharing permissions for organizations

As a G Suite administrator, you can control how users in your organization share Google Drive files and folders. This includes Google Docs, Sheets, Slides, My Maps, folders, and any other items stored on Drive. When users share folders, all of the folder contents usually get shared as well. 

This article is for administrators. To learn how to share your own files, or set permissions for your own files, go to Share files from Google Drive.

Before you begin (optional)

If you want to set permissions by department or domain

This information applies to G Suite Enterprise, Business, Education, and Nonprofits editions. Compare editions.

File owners can share their files based on the permissions you set for their organizational units:

  1. Add an organizational unit for each department or domain. For steps, see Add an organizational unit.
  2. Move users to your organizational units. For steps, see Move users to an organizational unit. 
  3. Set sharing permissions for each organizational unit using the instructions below.

If file owners move to different organizational units, or if file ownership transfers to someone in a different organizational unit, the file's sharing permissions change to those of the new organizational unit.

Users can never share files they don’t own beyond what is allowed for the file owners. This is true even if users are in organizational units with more permissive sharing settings.

Set sharing permissions

Let users share with anyone
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. If you have the G Suite Enterprise, Business, Education, or Nonprofits edition, select the desired organizational unit. (Compare G Suite editions.) Otherwise, your settings apply to your entire organization.

  5. Under Sharing outside your organization, turn file sharing on, and choose sharing options:

    Option Description
    On Lets users invite people outside your organization to view, comment on, or edit shared files.
    For files owned by users in your organization, warn when sharing outside your organization
     

    (Optional) Alerts users to make sure files aren't confidential before they share them outside your organization. 

    Warnings are displayed only when users share files through Docs editor or Drive sharing dialogs. If users share files directly, such as by emailing links, warnings aren't displayed.​

    Allow users in your organization to send sharing invitations to people outside your organization who are not using a Google account (Optional) Lets users share files with people outside your organization who don't use Google accounts. If you uncheck this box, users can share files with outside recipients only if those recipients use Google accounts or are on a Google Groups mailing list.

    Note: Google accounts don’t have to use Gmail or G Suite addresses. A Google account is simply a unified sign-in system that provides access to Google products, including Docs, Sheets, and Slides. If someone doesn’t have a Google account, send them this link: https://accounts.google.com/signupwithoutgmail.

    • Require Google sign-in for external users to view file. Requires recipients to sign in to Google accounts before opening files. That is, unless files are shared publicly on the web or available to anyone with links, if you allow that.
    • Allow external users to preview file without Google sign-in. Lets recipients preview file contents in a read-only mode without signing in to Google accounts.

    To edit or comment on files, reviewers must sign in to Google accounts, and invitations must allow commenting or editing.

    Allow users in your organization to publish files on the web or make them visible to the world as public or unlisted files

    (Optional) Lets users:

    • Publish Docs, Sheets, and Slides via File and then  Publish to the Web. This makes files accessible and searchable to anyone on the web. 
    • Select sharing settings that make files visible to the world as either public or unlisted files. Learn more about who links can be shared with.

    If you uncheck this box, users can still send file-sharing invitations to anyone. They just can't make files public on the web. 

    This setting is not available in the legacy free edition of G Suite. All free edition users can publish files on the web or share the link with anyone.

  6. Click Save.

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

Restrict sharing outside whitelisted domains

This feature is available with G Suite Enterprise, Business, Education, and Nonprofits editions. Compare editions.

You can restrict file sharing to trusted (whitelisted) G Suite domains only. This keeps users from sharing files outside your organization. But it allows them to share files with business associates on other G Suite domains.

To be whitelisted, domains must be G Suite domains.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. If you have the G Suite Enterprise, Business, Education, or Nonprofits edition, select the desired organizational unit. (Compare G Suite editions.) Otherwise, your settings apply to your entire organization.

  5. Under Sharing outside your organization, choose sharing options:
    Option Description
    Whitelisted Domains

    Allows users in the specified organizational unit to share files with people in external whitelisted G Suite domains. In addition, users in whitelisted domains can access Google Forms that were created in the organizational unit and that require users to be signed in.

    For files owned by users in your organization, warn when sharing with users in whitelisted domains
     

    (Optional) Alerts users to make sure files aren't confidential before they share them with users in whitelisted domains. 

    Warnings are displayed only when users share files through Docs editor or Drive sharing dialogs. If users share files directly, such as by emailing links, warnings aren't displayed.​

    Allow users in your organization to receive files from users outside of whitelisted domains (Optional) Enables users to open files that are shared with them by people in domains that aren't on the whitelist. If you uncheck this box, users can open files only if they are shared by people in domains on the whitelist.
     
  6. Click Save.
  7. Add trusted G Suite domains to the whitelist. The whitelist is automatically available to all organizational units in your organization.

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

Restrict sharing outside your organization

You can restrict users from sharing or receiving the following items outside your organization:

  • Invitations to Docs, Sheets, and Slides, which can be used for 14 days after they are created 
  • Links to files stored in Drive
  • Email attachments that can be sent or received by users, uploaded directly from devices, and stored in Drive
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. If you have the G Suite Enterprise, Business, Education, or Nonprofits edition, select the desired organizational unit. (Compare G Suite editions.) Otherwise, your settings apply to your entire organization.

  5. Under Sharing outside of your organization, turn sharing off, and select options: 
    Option Description
    Off Prevents users from sharing Google Drive files with people outside your organization through invitations, links, and email attachments.
     
    Allow users in your organization to receive files from users outside of your organization (Optional) Prevents users from opening files shared from outside organizations. If you check this box, users can open files shared from outside your organization, but they can share within your organization only.
     
  6. Click Save.

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

Control files stored on Team Drives

This feature is available with G Suite Enterprise, Business, Education, and Nonprofits editions. Compare editions.

You can control whether users can move files and folders that are stored on Team Drives to locations outside your organization. 

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. If you have the G Suite Enterprise, Business, Education, or Nonprofits edition, select the desired organizational unit. (Compare G Suite editions.) Otherwise, your settings apply to your entire organization.

  5. In Moving content outside of your organization, select an option:
    Option Description
    Anyone Anyone with full access to a Team Drive can move files and folders from that Drive to a Drive location in a different organization. Learn about user access permissions.
     
    Only users in your organization Only people in your organization with full access can move files and folders from a Team Drive to a Drive location in a different organization.
     
    No one Files and folders on a Team Drive can’t be moved to a Drive location in a different organization.
     
  6. Click Save

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

 

Control Team Drive creation

You can control whether users can create Team Drives in your organization. For instructions, see Manage your Team Drives users and activity.

Set Access Checker options & the link-sharing default

Choose Access Checker options

When users share files through G Suite tools, Access Checker verifies that recipients have access to files. The service also prompts users to give access if necessary. This happens when users:

  • Send Gmail messages with links to files that haven't been shared with recipients.
  • “+” someone into a comment on a doc who doesn't have access to the doc.
  • Attach files to calendar events where guests don't have access to the files.

If users share files they don't own, Access Checker options come from the file owner's organizational unit. If users share multiple files, and different organizational unit settings apply, Access Checker options come from the least permissive organizational unit.

As an administrator, you can specify the level of access users can give.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. If you have the G Suite Enterprise, Business, Education, or Nonprofits edition, select the desired organizational unit. (Compare G Suite editions.) Otherwise, your settings apply to your entire organization.

  5. Click Sharing settings
  6. Under Access Checker, specify how you want users to resolve file-access issues: 
    Option Description
    Recipients only Gives users one option: give access to required recipients only.* This is the most restrictive setting. 
    Recipients only or your organization

    Gives users 2 options:

    • Give access to required recipients.*
    • Give access to everyone in your organization who has the link.
    Recipients only, your organization, or public (no Google account required)

    Gives users 3 options:

    • Give access to required recipients.*
    • Give access to everyone in your organization who has the link.
    • Make the file public (available to anyone who has the link).

    This setting, which is the least restrictive, is available only if sharing is turned on for your organization, and you allow users to publish files on the web.


    * Giving access to required recipients simply adds recipients to the sharing list. If the file has been shared with other people, they still have access.
     
  7. Click Save

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

Set the default for link sharing

You can set the default link-sharing option that is displayed to users when they share files from within Docs editors. Users can use this default or choose a different option for sharing their files. To prevent users from choosing a different sharing option, you can restrict file sharing.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. If you have the G Suite Enterprise, Business, Education, or Nonprofits edition, select the desired organizational unit. (Compare G Suite editions.) Otherwise, your settings apply to your entire organization.

  5. Under Link Sharing, select the default sharing option to be displayed in the link-sharing dialog when users share files:
    Option Description
    Off Only the file owner, and people the owner has shared the file with, can access the file.
     
    On - Anyone at your organization with the link Anyone in your organization who has the link can access the file. Files with this visibility don’t normally appear in search results unless there are links to them from other files that are searchable.
     
    On - Anyone at your organization Anyone in your organization can search for and view the file. However, a file with this visibility appears in a user’s Drive only after they access the file or the file is shared with them.
  6. Click Save.

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

Verify changes

It's best to wait 24 hours before you test any changes to sharing settings. During this time, both old and new settings might be intermittently enforced.

Was this article helpful?
How can we improve it?