This article is for administrators. To learn how to share or set permissions for your own files, go to Share files from Google Drive.
Supported for all Google Workspace, Cloud Identity, and G Suite editions
As an administrator, you can control if users can share Google Drive files and folders with people outside your organization. These sharing settings apply to items from Google Docs, Sheets, Slides, Sites project files, My Maps, folders, and anything else stored in Drive.
- Example sharing setting scenarios
- Turn on or off external sharing of files and folders in Drive
- Allow external sharing with only certain domains
- Control who can move content to a shared drive owned by another organization
- Try managing Drive sharing with trust rules
Note: To control sharing with external non-Google users, turn visitor sharing on or off.
Example sharing setting scenarios
Set up custom sharing for a group or organizational unitYou might want to allow users only in certain groups or organizational units to share content externally, and block external sharing for everyone else. You can do this with Drive sharing settings or with trust rules.
With Drive sharing settings:
- If you haven’t already, put the users in organizational units or configuration groups.
- Turn off external sharing for the top organizational unit, as described in the next section.
- At the left, click the group or organizational unit you want to allow to share externally.
Important: Group settings override organizational unit settings. If a user belongs to multiple groups, the setting for the group with the highest priority is applied to the user.
- Turn on external sharing.
With trust rules: Learn how in Create and manage trust rules for Drive sharing.
You can let users share files and folders with external users who don’t have Google Accounts by turning on visitor sharing. You can choose to allow visitor sharing with anyone or only trusted domains. For instructions, see Allow sharing to non-Google users with visitor sharing.
Supported editions for this feature: Business Starter, Business Standard, and Business Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, Teaching and Learning Upgrade, and Education Plus; Essentials, Enterprise Essentials, and Enterprise Essentials Plus; Nonprofits; G Suite Business. Compare your edition
The sharing settings available in your Admin console apply to users by organizational unit or groups. You don’t have control over individual folders in users My Drives.
To allow only certain files to be shared externally, you can use shared drives instead. With this approach, the shared drive acts as the folder.
- Create an organizational unit with no members.
- Turn off external sharing for the top organizational unit, as described in the next section.
- Turn on external sharing for the new organizational unit, overriding the setting for the top organizational unit.
- (Optional) To allow sharing with people outside your organization without Google Accounts, turn on visitor sharing for the new organizational unit.
- Create a shared drive to contain files and folders for external sharing.
- Identify the people allowed to share the files externally and add those people as members of the shared drive with the Contributor, Content manager, or Manager access level. If you have many users, add them as a group.
Note:
- You can add people outside of your organization as members of a shared drive if they have Google Accounts. If they don’t have Google Accounts, you can turn on visitor sharing so your users can share content with them.
- Review and understand the permissions granted by each access level. Determine the right access level for the shared drive members based on your organization’s specific needs.
- Assign the shared drive to the new organizational unit.
- Move content into the shared drive.
- (Optional) If you want to be notified when content is added to the shared drive and shared externally, you can set up a reporting rule based on Drive log events.
Turn on or off external sharing of files and folders in Drive
Sharing content in Drive with people outside your organization can be an important collaboration process, but it also carries risk of data leaks. If you turn on external sharing, you have options to limit sharing, such as warning users before they share or blocking link sharing.
If you turn off external sharing, users can’t share the following items with external users:
- Invitations to items created in Docs, Sheets, and Slides
- Links to files stored in Drive
- Items attached to emails, either uploaded directly from devices or stored in Drive
External users also lose access to any items previously shared with them.
You can also block these same items coming from external users to users in your organization. These restrictions apply to external group members. When files are shared with a group that has external users, those external users can’t access the file.
To turn external sharing on or off:
-
Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
-
In the Admin console, go to Menu
Apps
Google Workspace
-
Click Sharing settings > Sharing options.
-
(Optional) To apply the setting only to some users, at the side, select an organizational unit (often used for departments) or configuration group (advanced). Show me how
Group settings override organizational units. Learn more
- To turn on external sharing, click On and choose sharing options.
- To turn off external sharing, click Off. You can also block external content from being shared with your users, including content in third-party storage systems.
-
Click Save. Or, you might click Override for an organizational unit.
To later restore the inherited value, click Inherit (or Unset for a group).
Allow external sharing with only certain domains
You can allow file sharing with only trusted (allowed) domains. When you use an allowlist to restrict sharing:
- The domain must be a Google Workspace domain unless you’re using visitor sharing.
- You can’t select only certain domains in the allowlist for file sharing. All trusted domains are included.
- Users can’t share files with personal accounts.
- If your organization has a mix of Cloud Identity and Google Workspace licenses, the allowlist applies to Cloud Identity users, too.
Before you begin: If needed, learn how to apply the setting to a department or group.
If you haven’t already, add trusted domains to your allowlist.
-
Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
-
In the Admin console, go to Menu
- Click Sharing settings
-
(Optional) To apply the setting only to some users, at the side, select an organizational unit (often used for departments) or configuration group (advanced). Show me how
Group settings override organizational units. Learn more
- Click Allowlisted Domains and choose sharing options.
-
Click Save. Or, you might click Override for an organizational unit.
To later restore the inherited value, click Inherit (or Unset for a group).
It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.
Control who can move content to a shared drive owned by another organization
You can allow or block moving content from shared drives that involve an external source or target. For example:
- You can block moving content from a shared drive in your organization to an external shared drive or external user's My Drive.
- You can block moving content from a user's My Drive in your organization to an external shared drive.
For details, go to Control sharing for your organization.
Try managing Drive sharing with trust rules
Supported editions for this feature: Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus. Compare your edition
Instead of using Drive settings for sharing outside your organization, you can use trust rules to manage sharing both outside and inside your organization. Trust rules give you more control over who your users can share with. For details, see Create and manage trust rules for Drive sharing.
