Control sharing in Team Drives

This feature is available with G Suite Enterprise, Enterprise for Education, Drive Enterprise, Business, Education, and Nonprofits edition. Compare editions

As a G Suite administrator, you can restrict content sharing for a Team Drive or all new Team Drives. You can apply these restrictions to new or existing Team Drives in a specific organizational unit or to your entire organization.

You can also prevent Team Drive members with Manager access from modifying settings. In the Team Drive, you can restrict:

  • Non-members from accessing files 
  • People outside your organization from accessing files
  • Commenters and viewers from downloading, copying, and printing files

Moving and sharing files

When a file is moved into a Team Drive, it keeps its file-sharing permissions. So if an owner sets their file to prevent downloading, copying, and printing, it stays like that after being moved to a Team Drive. Moving files does not affect Team Drives sharing permissions or user roles, such as Editor or Viewer.

Users cannot share files with anyone outside the Team Drive’s restrictions. For example, if a Team Drive restricts users outside the organization from accessing its content, the system removes any external users from the Team Drive file.

Changes to the Team Drive’s restriction settings do not remove users or change a file’s sharing permissions. For example, assume a user outside the domain is added to a file. Then later on, a restriction is applied on the Team Drive. In that case, the user is not removed. This means a user might regain access if restrictions are relaxed in the future.

Set the default access for all new Team Drives

Admins can currently define the following options to restrict access to all new Team Drives. See the G Suite Updates blog for more information.

Use the default sharing restrictions to restrict access to the content in all new Team Drives. These protection settings must be actively enabled. 

 Define the default sharing restrictions

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Select Sharing settings.
  4. If you want to turn on this feature for only some users, on the left, select an organizational unit. Otherwise, it applies to everyone.

    You can only select an organizational unit for this feature if you have G Suite Enterprise, Business, Education, Nonprofits, or Drive Enterprise edition. (Compare G Suite editions.)

  5. Next to Team Drive creation, select the settings you want to apply to all new Team Drives by default.
    • Prevent users in your organization from creating new Team Drives
    • Prevent Managers from modifying Team Drive settings
    • Prevent people outside your organization from accessing files in the Team Drive
    • Prevent non-members of the Team Drive from accessing files in the Team Drive
    • Prevent commenters and viewers from downloading, copying and printing files in the Team Drive

Note: If Prevent Managers from modifying the Team Drive’s settings is not checked, full access members can override any of these default settings for individual Team Drives.

Key things to remember

  • If a document is moved in to a Team Drive with default sharing restrictions:
    • These default settings override any document-level sharing settings, which might result in some users losing access to documents. If members will lose access, a warning is displayed before the file is moved. 
    • The document’s protections still apply if the Team Drive has less restrictive protections. 
  • If a document is moved out of the Team Drive to My Drive within the same organization:
    • The document’s original sharing settings are used instead. This can result in users gaining or losing access.
    • Document-level restrictions always stay in place unless specifically changed or removed from the document. Team Drive restrictions only apply to documents when they are in the Team Drive. 
  • Changes to these default settings do not affect existing Team Drives:
    • If these default settings are changed, users are not removed from the Team Drive or individual file permissions. 
    • If the Team Drive restrictions are more restrictive than the file permissions, however, some users will lose access to the file. 
    • If the Team Drive default restrictions are removed, some users might regain access.

Restrict access for an existing Team Drive

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Select Manage Team Drives.
  4. Next to a Team Drive, click Settings Settings
  5. Select Prevent Managers from modifying Team Drive settings to disable the sharing settings for the Team Drive.
  6. If the sharing settings are enabled, select Edit to modify the following additional options for the Team Drive. Prevent or allow: 
    • Sharing outside your organization—Allow or prevent people outside your domain from accessing files in the Team Drive.
    • Sharing with non-members—Allow or prevent Team Drive members from giving non-members access to files in the Team Drive.
    • Download, copy, and print—Allow or prevent commenters and viewers from downloading, copying, and printing files in the Team Drive.

Control sharing for your organization

Use the following settings to restrict sharing for your organization. These settings apply to all Drive files. For example, if your organization restricts sharing outside of the organization, sharing Team Drives content is also restricted.

Restrict users from moving content outside of your domain
 

This feature is available with G Suite Enterprise, Enterprise for Education, Drive Enterprise, Business, Education, and Nonprofits edition. Compare editions

You can control who can move files and folders outside of your organization in these situations:

  • Moving content from a Team Drive in your organization to a Team Drive owned by another organization
  • Moving content from a Team Drive in your organization to someone’s My Drive in another organization
  • Moving content from someone’s My Drive in your organization to a Team Drive owned by another organization
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Appsand thenG Suiteand thenDrive and Docs.
  3. Click Sharing settings.
  4. Select the desired organizational unit.

    Important: If you select a child organizational unit, this setting only controls moving content from someone’s My Drive to a Team Drive in a different organization (for example, another business or school). Moving content from a Team Drive to another organization is always controlled by the top-level organization setting. This is because Team Drives are owned by the top-level organization.
     
  5. In Moving content outside of your organization, select an option from the table below.
  6. Click Save.
     
    Option Description
    Anyone Anyone with Manager access to a Team Drive can move files from that Team Drive to a Drive location in a different organization. Learn about user access permissions.

    In addition, anyone in the selected organizational unit can copy content from their My Drive to a Team Drive owned by a different organization (for example, another business, group, or school). Learn about migrating content to a Team Drive.
     
    Only users in your organization Only people in your organization with Manager access to a Team Drive can move files from that Team Drive to a Drive location in a different organization.

    In addition, users in the selected organizational unit can copy content from their My Drive to a Team Drive owned by a different organization.
     
    No one Files on a Team Drive cannot be moved to a Drive location in a different organization.

    In addition, no one in the selected organizational unit can copy content from My Drive to a Team Drive owned by a different organization.
     

It can take up to 24 hours to see changes. During this time, both old and new settings might be intermittently enforced.

Set file-sharing permissions

Set permissions for your organization

As a G Suite administrator, you can control if users can share files outside of your organization. See Set file-sharing permissions for your organization
Team Drives use the domain's top-level organization settings. For example, if external sharing is disabled for the user's organizational unit but allowed at the top-level organization, the user can share documents in Team Drives with people outside the company.
G Suite administrators can define additional restrictions for each organizational unit using the default settings for the creation of new Team Drives. A Team Drive’s restrictions cannot be broader than the top-level organization’s restrictions. But you can use the default settings to further restrict access for Team Drives created in specific organizational units.

Share all files and folders in a Team Drive

Add members to a Team Drive to share the files in the Team Drive.

See Share files with Team Drives for more information.

Share a specific file

Team Drive members can also share specific files with people who are not members of the Team Drive.

See Share files from Team Drives for more information.

 

Was this article helpful?
How can we improve it?