Set sharing permissions

Let users in your organization share with anyone

You can let users invite people outside your organization to access shared files. You can also let them make files public on the web.

Cloud Identity customers: If every one of your users has a Cloud Identity license, they can always share files with users outside your organization and publish files on the web for anyone to access.

  1. In your Google Admin console (at admin.google.com)...
  2. Click Sharing settingsand thenSharing options.
  3. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

    Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials. Compare your edition

  4. For Sharing outside of your organization, click On and choose sharing options:
    • Warn when sharing outside of your organization—To protect confidentiality, warnings display in Docs editor or Drive sharing dialogs when users share files outside your organization.
    • Send sharing invitations to people outside your organization who are not using a Google Account—Users can share files with people who don’t use Google Accounts. However, to edit or comment on files, users must sign in to a Google Account (or a visitor account if you have visitor sharing turned on).
    • Allow users to publish files on the web or make them visible as public or unlisted files—Users can:
      • Make files accessible and searchable to anyone on the web. Learn more
      • Select sharing settings that make files visible to the world as public or unlisted files. Learn more
  5. Click Save.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Restrict sharing outside of allowed domains

Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Essentials. Compare your edition

You can restrict file sharing to trusted (allowed) domains only. When you use an allowlist to restrict sharing:

  • The domain must be a Google Workspace domain unless you’re using visitor sharing. For details, go to Allow sharing to non-Google accounts.
  • Users can’t share files with personal (Gmail) accounts.
  • If your organization has a mix of Cloud Identity and Google Workspace licenses, domains on an allowlist configuration for Google Workspace users also apply to users with Cloud Identity licenses.

To restrict sharing to domains on an allowlist:

  1. In your Google Admin console (at admin.google.com)...
  2. Click Sharing settingsand thenSharing options.
  3. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

    Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials. Compare your edition

  4. For Sharing outside of your organization, click Whitelisted Domainsand choose sharing options:
    • Warn when sharing with users in whitelisted domains—To protect confidentiality, warnings display in Docs editor or Drive sharing dialogs when users share files with users in a domain on an allowlist.
    • Allow users to receive files from users outside of whitelisted domains—Users can:
      • Open files from domains that aren’t on an allowlist.
      • Use Docs editors to edit Google Docs, Sheets, and Slides stored on third-party storage systems, such as Box. Learn more
    • Allow users to send sharing invitations to people who are not using a Google Account—Allows PIN-verified sharing to non-Google users in domains on your allowlist. Learn more
  5. Click Save.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Next step: Add trusted domains to your allowlist

For details, go to Allow external sharing with only trusted domains.

Restrict sharing outside your organization

Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Essentials. Compare your edition

You can restrict users from sharing or receiving the following items outside your organization:

  • Invitations to Docs, Sheets, and Slides, which are active for 14 days 
  • Links to files stored in Drive
  • Email attachments that users can send or receive, uploaded directly from devices and stored in Drive
  1. In your Google Admin console (at admin.google.com)...
  2. Click Sharing settingsand thenSharing options.
  3. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

    Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials. Compare your edition

  4. For Sharing outside of your organization, click Off
  5. (Optional) To keep users from opening or editing files from domains not on your allowlist or in third-party storage systems, uncheck the box to Allow users in your organization to receive files from outside users.
    Note: If you set a policy that restricts external users from accessing your organization’s information, users can share files with a group that has external users, but those users can’t access the files.
  6. Click Save.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

Control files stored on shared drives

Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Essentials. Compare your edition

You can control who can move files and folders outside of your organization when moving content from:

  • A shared drive in your organization to: 
    • A shared drive owned by another organization
    • Someone’s My Drive in another organization
  • Someone’s My Drive in your organization to a shared drive owned by another organization 
  1. In your Google Admin console (at admin.google.com)...
  2. Click Sharing settingsand thenSharing options.
  3. Select the desired organizational unit or group
  4. In Distributing content outside of your organization, select an option:
    • Anyone
      • People with Manager access to a shared drive can move files from that shared drive to a Drive location in a different organization. Learn more
      • People in the selected organizational unit or group can move content from their My Drive to a shared drive owned by a different organization (for example, another business, group, or school). Learn more
    • Only users in your organization
      • People with Manager access to a shared drive can move files from that shared drive to a Drive location in a different organization.
      • Users in the selected organizational unit or group can move content from their My Drive to a shared drive owned by a different organization.
    • No one
      • Files on a shared drive cannot be moved to a Drive location in a different organization.
      • No one in the selected organizational unit or group can move content from My Drive to a shared drive owned by a different organization.
      • No one in the selected organizational unit or group can create files on a shared drive owned by another organization.
  5. Click Save.

Important: If you select a child organizational unit or group, this setting only controls moving content from someone’s My Drive to a shared drive in a different organization (for example, another business or school). Settings at the top-level organizational unit, which owns shared drives, always controls content moving from a shared drive to another organization.

It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.

 

Control shared drive creation

You can control whether users can create shared drives in your organization. For details, go to Allow users to create shared drives.

Allow users to share files publicly
Here are quick steps any user can take to make a file public to anyone:
  1. In your Google Admin console (at admin.google.com)...
  2. Click Sharing settingsand thenSharing options.
  3. For Sharing outside of your organization, click On.
    Note: This setting applies to files in shared drives as well.
  4. Check the following boxes: 
    • For files owned by users in your organization warn when sharing outside of your organization
    • Allow users in your organization to send sharing invitations to people outside your organization who are not using a Google account
    • Allow users in your organization to publish files on the web or make them visible to the world as public or unlisted files
  5. Click Save.
It can take up to 24 hours to see changes. During this time, old and new settings might be intermittently enforced.