Manage external sharing for your organization

This article is for administrators. To learn how to share or set permissions for your own files, go to Share files from Google Drive.

As an administrator, you can control if users can share Google Drive files and folders with people outside your organization who have Google Accounts. These sharing settings apply to items from Google Docs, Sheets, Slides, Sites project files, My Maps, folders, and anything else stored in Drive.

Depending on your Google Workspace edition, you can:

• turn external sharing on or off for your entire organization
• turn external sharing on or off for specific child organizational units or configuration groups
• allow sharing only with certain domains
• restrict link sharing when external sharing is turned on
• restrict external user access to content in shared drives

Note:

• If you need more granular control over sharing, you can use trust rules to manage sharing both outside and inside your organization. For instructions, see Create and manage trust rules for Drive sharing.
• To control sharing with external non-Google users, turn visitor sharing on or off.

Example sharing setting scenarios

Expand all  |  Collapse all

Set up custom sharing for a group or organizational unit

You might want to allow only users in certain groups or organizational units to share content externally, and block external sharing for everyone else. You can do this with Drive sharing settings or with trust rules.

With Drive sharing settings:

1. If you haven’t already, put the users in organizational units or configuration groups.
2. Turn off external sharing for the top organizational unit, as described in the next section.
3. At the left, click the group or organizational unit you want to allow to share externally.

   Important: Group settings override organizational unit settings. If a user belongs to multiple groups, the setting for the group with the highest priority is applied to the user.

4. Turn on external sharing.

With trust rules: Learn how in Create and manage trust rules for Drive sharing.

Share content with external users who don’t have Google Accounts

You can let users share files and folders with external users who don’t have Google Accounts by turning on visitor sharing. You can choose to allow visitor sharing with anyone or only trusted domains. For instructions, see Allow sharing to non-Google users with visitor sharing.

Allow only content in specific folders to be shared externally

Supported editions for this feature: Business Standard and Business Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, Teaching and Learning Upgrade, and Education Plus; Essentials, Enterprise Essentials, and Enterprise Essentials Plus; Nonprofits; G Suite Business.  Compare your edition

The sharing settings available in your Admin console apply to users by organizational unit or groups. You don’t have control over individual folders in users My Drives.

To allow only certain files to be shared externally, you can use shared drives instead. With this approach, the shared drive acts as the folder.

1. Create an organizational unit with no members.
2. Turn off external sharing for the top organizational unit, as described in the next section.
3. Turn on external sharing for the new organizational unit, overriding the setting for the top organizational unit.
4. (Optional) To allow sharing with people outside your organization without Google Accounts, turn on visitor sharing for the new organizational unit.
5. Create a shared drive to contain files and folders for external sharing.
6. Identify the people allowed to share the files externally and add those people as members of the shared drive with the Contributor, Content manager, or Manager access level. If you have many users, add them as a group.

   Note:

   • You can add people outside of your organization as members of a shared drive if they have Google Accounts. If they don’t have Google Accounts, you can turn on visitor sharing so your users can share content with them.
   • Review and understand the permissions granted by each access level. Determine the right access level for the shared drive members based on your organization’s specific needs.
7. Assign the shared drive to the new organizational unit.
8. Move content into the shared drive.
9. (Optional) If you want to be notified when content is added to the shared drive and shared externally, you can set up a reporting rule based on Drive log events.

Turn on or off external sharing of files and folders in Drive

Sharing content in Drive with people outside your organization can be an important collaboration process, but it also carries risk of data leaks. If you turn on external sharing, you have options to limit sharing, such as warning users before they share or preventing link sharing.

If you turn off external sharing, users can’t share the following items with external users:

• Invitations to items created in Docs, Sheets, and Slides
• Links to files stored in Drive
• Items attached to emails, either uploaded directly from devices or stored in Drive

You can also block these same items coming from external users to users in your organization. These restrictions apply to external group members. When files are shared with a group that has external users, those external users can’t access the file.

To turn external sharing on or off:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle WorkspaceDrive and Docs.

3. Click Sharing settings > Sharing options.

4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.
5. To turn on external sharing:
   1. In the Sharing outside of your organization section, click On and choose sharing options.
   2. To warn users when they try to share externally, check the Warn when files owned by users or shared drives in your organization are shared outside of your organization box.
   3. To allow users to share content with people who don’t use Google Accounts, check the Allow users or shared drives in your organization to share items with people outside your organization who aren't using a Google account box.

      Note: To edit or comment on files, users must sign in to a Google Account (or a visitor account if you have visitor sharing turned on)

   4. To allow link sharing (when anyone with the link can access the file), check When sharing outside of your organization is allowed, users in your organization can make files and published web content visible to anyone with the link.
6. To turn off external sharing:
   1. In the Sharing outside of your organization section, click Off.
   2. To also prevent external content being shared with your users, including content in third-party storage systems, uncheck Allow users in your organization to receive files from users outside of your organization.
7. Click Save. If you configured an organizational unit or group, you might be able to either Inherit or Override a parent organizational unit, or Unset a group.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Allow external sharing with only certain domains

Supported editions for this feature: Business Standard and Business Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, Teaching and Learning Upgrade, and Education Plus; Essentials, Enterprise Essentials, and Enterprise Essentials Plus; G Suite Business.  Compare your edition

You can allow file sharing with only trusted (allowed) domains. When you use an allowlist to restrict sharing:

• The domain must be a Google Workspace domain unless you’re using visitor sharing.
• You can’t select only certain domains in the allowlist for file sharing. All trusted domains are included.
• Users can’t share files with personal accounts.
• If your organization has a mix of Cloud Identity and Google Workspace licenses, domains allowed for Google Workspace users also apply to Cloud Identity users.

Before you begin: To apply the setting for certain users, put their accounts in an organizational unit (to set by department) or a configuration group (to set for users across or within departments).

If you haven’t already, add trusted domains to your allowlist.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle WorkspaceDrive and Docs.
3. Click Sharing settingsSharing options.
4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.
5. In the Sharing outside of your organization section, click Allowlisted Domains and choose sharing options:
   1. To warn users when they try to share with users in a trusted domain, check the Warn when files owned by users or shared drives in your organization are shared outside of your organization box.
   2. To allow users to open files from domains that aren’t on an allowlist and edit Google Docs, Sheets, Slides, and Sites stored on third-party storage systems, check Allow users in your organization to receive files from users outside of allowlisted domains.
   3. To allow PIN-verified visitor sharing with non-Google users in trusted domains, check the Allow users or shared drives in your organization to share items with people outside your organization who aren't using a Google account box.
6. Click Save. If you configured an organizational unit or group, you might be able to either Inherit or Override a parent organizational unit, or Unset a group.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Control who can move content to a shared drive owned by another organization

You can control who can move files and folders outside of your organization when moving content from:

• A shared drive in your organization to a shared drive owned by another organization or someone’s My Drive in another organization
• A My Drive in your organization to a shared drive owned by another organization

For details on controlling who can access files stored on shared drives, go to Control sharing for your organization.

Try managing Drive sharing with trust rules

Supported editions for this feature: Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus.  Compare your edition

Instead of using Drive settings for sharing outside your organization, you can use trust rules to manage sharing both outside and inside your organization. Trust rules give you more control over who your users can share with. For details, see Create and manage trust rules for Drive sharing.

Related topics

• Set general access options for file sharing in Drive
• Restrict the access users can give to files