Set file sharing permissions

As a Google Apps administrator, you determine whether users can share their Drive files and folders outside your organization, plus the default link sharing option for new Docs, Sheets, and Slides that your users create.

The term "files" is used in this article to refer to all Google files (such as Docs, Sheets, and Slides) as well as Drive folders.

Restrict users from sharing files outside your organization
  1. Sign in to the Google Admin console.
  2. Click Apps > Google Apps > Drive > Sharing settings. Where is it?
  3. If you have Google Apps Unlimited, Google Apps for Education, or Google Apps for Nonprofits, select the desired organizational unit in the left panel.

    For all other editions, you won’t see an option to select an organizational unit. Your sharing settings apply to your entire organization.

  4. Under Sharing outside of organization, select OFF.
    Users can't invite people outside the organization to view, comment on, or edit their files.

    Your users can always send or receive files as email attachments; this setting controls only the live online sharing of Docs, Sheets, and Slides.
  5. (Optional) Check Allow users in organization to receive files from users outside of domain.
    Users can access external Google files, but they can't share their own files externally.

    If you don't check this box, users can't access any files outside your domain, including files from other domains that are public on the web.

Allow users to share outside your organization only to whitelisted domains

This feature is available only with Google Apps Unlimited, Google Apps for Education, or Google Apps for Nonprofits.

You might want to generally restrict users from sharing documents outside your domain, but still have the need to share with specific external Google Apps domains, such as in business partnerships, vendor relationships, and organizations split across multiple Google Apps domains.

To allow external sharing with only whitelisted domains:

  1. Sign in to the Google Admin console.
  2. Click Domains > Whitelisted Domains to specify the list of Google Apps domains that you trust.

    Whitelisted domains must be Google Apps domains. If you add non-Google Apps domains to the Whitelisted Domains list, they will still not be whitelisted. Also note that subdomains and domain aliases aren't included when you add a whitelisted domain, so add these separately if needed. See Set up whitelisted domains to learn more.

  3. From the Admin console dashboard, click Apps > Google Apps > Drive > Sharing settings. Where is it?
  4. In the left panel, select the desired organizational unit.
  5. Under Sharing outside of organization, select ON - Whitelisted Domains.
    Users in the specified organizational unit can invite people in external whitelisted domains to view, comment on, and edit their files. They can also receive files from whitelisted domains. Google Forms created within the organizational unit with “Require login to view this form” selected can also be accessed by signed-in users from whitelisted domains.
  6. Check all the following options that apply:

    • For files owned by users in organization, warn when sharing with users in whitelisted domains
      Users will be asked to confirm when they share to any external whitelisted domain. This serves as a reminder to make sure the shared file is not confidential.
    • Allow users in organization to receive files from users outside of whitelisted domains
      Users can access files from non-whitelisted external domains, but they can only share externally to whitelisted domains.

      If you don’t check this box, users can’t access any files outside your domain or whitelisted domains, including files from other domains that are public on the web.

Allow users to share outside your organization to anyone
  1. Sign in to the Google Admin console.
  2. Click Apps > Google Apps > Drive > Sharing settings. Where is it?
  3. If you have Google Apps Unlimited, Google Apps for Education, or Google Apps for Nonprofits, select the desired organizational unit in the left panel.

    For all other editions, you won’t see an option to select an organizational unit. Your sharing settings apply to your entire organization.

  4. Under Sharing outside of organization, select ON.
    Users can invite people outside the organization to view, comment on, and edit their files.

  5. Select any or all of the following:

    • For files owned by users in organization, warn when sharing outside domain
      Users will be asked to confirm when they share externally. This serves as a reminder to make sure the shared file is not confidential. This setting is selected by default.

    • Allow users in organization to send sharing invitations to people outside domain who are not using a Google account
      Users can send external sharing invitations to non-Google email accounts and non-Google Groups mailing lists. If you don’t select this option, files can only be shared with non-Google accounts and mailing lists within your domain.

      Important: People with non-Google accounts who receive a sharing invitation can forward it to other people. Invitations expire after 14 days.

      If you select this option, you then choose whether people with the sharing invitation must sign in to a Google account in order to view the file:

      • Require Google sign-in for external users to view file
        When a sharing invitation is sent to a non-Google email account or non-Google Groups mailing list, people with the sharing invitation will still need to sign in to a Google account to view the file (unless it's also shared publicly on the web or to anyone with the link, if you allow that).

        By requiring sign-in, people who access the file are visible in the Advanced section of the file’s share box, where access can be removed. 

        If the recipient doesn’t have a Google account, he or she will need to sign up for one.

        Google accounts don’t have to use Gmail or Google Apps addresses. A Google account is simply a unified sign-in system that provides access to Google products, including Docs, Sheets, and Slides. You can associate any email address with a Google account. To get someone who doesn't have a Google account started, send them this link: https://accounts.google.com/signupwithoutgmail
      • Allow external users to preview file without Google sign-in
        People with the sharing invitation can view the file in a read-only preview mode without needing to sign in to a Google account, and they can forward the invitation to other people who can also view the file.

        People viewing the file without a Google account are not listed in the file’s share box, in the Advanced section under Who has access.

        If the file was shared with edit or comment access, anyone with the sharing invitation will still need to sign in to a Google account before they can edit or comment on the file (unless it's shared publicly on the web or to anyone with the link, if allowed by the next Admin console option).

    • Allow users in organization to publish files on the web or make them visible to the world as public or unlisted files
      Users can publish files or set visibility for files as Public on the web (meaning anyone on the Internet can find and access the file) or Anyone with the link (meaning it’s an unlisted file that’s not likely to show up in search results, but it is accessible to anyone who knows the link).

      If you check this box, users can set the visibility option of files to Public on the web via sharing options, and they can also publish Docs, Sheets, and Slides via File > Publish to the Web. To learn more, see Visibility of documents, spreadsheets, and presentations published to the web.

      If you don’t check this box, the only way users can share files outside your organization is to specifically invite each collaborator to access the file.

      This setting is not available in the legacy free edition of Google Apps. All free edition users can publish files on the web or to anyone with the link.
Choose the default Link Sharing setting
  1. Sign in to the Google Admin console.
  2. Click Apps > Google Apps > Drive > Sharing settings. Where is it?
  3. If you have Google Apps Unlimited, Google Apps for Education, or Google Apps for Nonprofits, select the desired organizational unit in the left panel.

    For all other editions, you won’t see an option to select an organizational unit. Your sharing settings apply to your entire organization.

  4. Select the default Link Sharing option for new files created by your users.

    This setting determines how visible files are to other people. Users can override the default Link Sharing setting for any individual file, though they can never share outside the organization if you disallow that as described above.

    • OFF
      The file is not accessible to anyone other than the owner and the people to whom the owner explicitly gives access.

    • ON - People at organization with the link
      Anyone in your organization can access the file, but only if they know the URL. This is like an unlisted phone number where only people who know your number can call you.

      Files with this visibility won’t normally be found in search results, except possibly if a file is linked to from within another searchable file.

    • ON - People at organization
      The file is searchable and viewable to everyone in your organization. However, the file will only appear in a user’s Drive after it has been accessed by the user, or after the file has been explicitly shared with the user.

Notes about sharing settings:

  • With Google Apps Unlimited, Google Apps for Education, or Google Apps for Nonprofits, files always inherit sharing policy from the organizational unit of the file owner. A file may therefore inherit a new sharing policy if the owner moves to a new organizational unit or if file ownership is transferred to someone in a different organizational unit.

    You can never share a file you don’t own beyond what is allowed for the file’s owner, even if you are in an organizational unit with a more permissive sharing policy.

  • It can take up to 24 hours for settings changes to take effect. During this time, both old and new policies may be intermittently enforced.
Does your organization use multiple domains?

If so, see Limitations for multiple domains to learn about restrictions with sharing across domains and considerations for naming your primary domain.