Set Drive users' sharing permissions

This article is for administrators. To learn how to share or set permissions for your own files, go to Share files from Google Drive. 

As an administrator, you can control how users in your organization share Google Drive files and folders. These include items from Google Docs, Sheets, Slides, and My Maps as well as folders and anything else stored in Drive.

Before you begin

• You can make the same sharing rules for everyone. Or, set different rules for groups or departments. To apply the setting for certain users, put their accounts in an organizational unit (to set by department) or a configuration group (to set for users across or within departments).
• Use target audiences to recommend which groups of people users should share with, such as departments or teams. For information about setting up target audiences, go to About target audiences.

Let users share files outside of your organization

1. From the Admin console Home page, go to AppsGoogle WorkspaceDrive and Docs.
2. Click Sharing settingsSharing options.

3. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

   Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials.  Compare your edition

4. For Sharing outside of your organization, click On and choose sharing options:

   • Warn when sharing outside of your organization—To protect confidentiality, users get a warning when they try to share outside of your organization.
   • Send sharing invitations to people outside of your organization who aren't using a Google Account—Users can share files with people who don’t use Google Accounts. 
     Note: To edit or comment on files, users must sign in to a Google Account (or a visitor account if you have visitor sharing turned on).
   • Allow users to make files and published web content visible to anyone with the link
5. Click Save. If you configured an organizational unit or group, you might be able to Inherit or Override a parent organizational unit, or Unset a group.

It can take up to 24 hours for changes to appear. During this time, older and newer settings might be intermittently enforced.

Restrict sharing to certain domains

You can restrict file sharing to trusted (allowed) domains. When you use an allowlist to restrict sharing:

• The domain must be a Google Workspace domain unless you’re using visitor sharing. 
• Users can’t share files with personal accounts.
• If your organization has a mix of Cloud Identity and Google Workspace licenses, domains on an allowlist configuration for Google Workspace users also apply to users with Cloud Identity licenses.

To set allowlist settings:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. From the Admin console Home page, go to AppsGoogle WorkspaceDrive and Docs.
3. Click Sharing settingsSharing options.

4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

   Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials.  Compare your edition

5. For Sharing outside of your organization, click Whitelisted Domains and choose sharing options:
   • Warn when sharing with users in whitelisted domains—To protect confidentiality, users get a warning when trying to share files with users in a domain on an allowlist.
   • Allow users to receive files from users outside of whitelisted domains—Users can open files from domains that aren’t on an allowlist and edit Google Docs, Sheets, and Slides stored on third-party storage systems.  
   • Allow users to send sharing invitations to people who are not using a Google Account—Allows PIN-verified visitor sharing to non-Google users in domains on your allowlist. 
6. Click Save. If you configured an organizational unit or group, you might be able to Inherit or Override a parent organizational unit, or Unset a group.

It can take up to 24 hours for changes to appear. During this time, older and newer settings might be intermittently enforced.

Restrict all file sharing outside of your organization

You can restrict users from sharing or receiving the following items outside of your organization:

• Invitations to items in Docs, Sheets, and Slides, which are active for 14 days 
• Links to files stored in Drive
• Email attachments that users can send or receive, uploaded directly from devices and stored in Drive

To restrict file sharing outside of your organization:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. From the Admin console Home page, go to AppsGoogle WorkspaceDrive and Docs.
3. Click Sharing settingsSharing options.

4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

   Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials.  Compare your edition

5. For Sharing outside of your organization, click Off. 
6. (Optional) To keep users from opening or editing files from outside of your organization or in third-party storage systems, uncheck the Allow users in your organization to receive files from users outside of your organization box.
   Note: If you set a policy that restricts external users from accessing your organization’s information, users can share files with a group that has external users, but those users can’t access the files.
7. Click Save. If you configured an organizational unit or group, you might be able to Inherit or Override a parent organizational unit, or Unset a group.

It can take up to 24 hours for changes to appear. During this time, older and newer settings might be intermittently enforced.

Control how users share links to files

You can control the options that users get when they try to share links to files from My Drive. The options do not apply to files and folders in shared drives. 

Cloud Identity customers: If your organization has a mix of Cloud Identity and Google Workspace licenses, the link-sharing setting for the Google Workspace users also applies to the users with Cloud Identity licenses.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. From the Admin console Home page, go to AppsGoogle WorkspaceDrive and Docs.
3. Click Sharing settings.
4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

   Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials.  Compare your edition

5. Click Link sharing default.
6. Choose an option:
   • Off—Only the file owner and people the owner has shared the file with can access the file.
   • On - Anyone at your organization with the link—Anyone in your organization who has the link can access the file. Files with this visibility don’t normally appear in search results unless there are links to them from other files that are searchable.
   • On - Anyone with the link—Anyone in your organization can search for and view the file. However, a file with this visibility appears in a user’s Drive only after they access the file or the file is shared with them.
     Important: If you set a target audience for the sharing settings rather than anyone at your organization, the target audience options show instead.
7. Click Save. If you configured an organizational unit or group, you might be able to Inherit or Override a parent organizational unit, or Unset a group.

It can take up to 24 hours for changes to appear.

Restrict the access levels users can give to files

You can decide what level of access users can give to files when they are  prompted to share a file. Users get prompted to share when they:

• Send Gmail or Google Chat messages with links to files that haven't been shared with recipients.
• +mention someone in a comment in a file who doesn't have access.
• Attach files to Google Calendar events where guests don't have access to the files.

If users share files they don't own, the sharing options come from the file owner's organizational unit. If users share multiple files and different organizational unit settings apply, the options come from the least permissive organizational unit.

To assign the level of access users can give:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. From the Admin console Home page, go to AppsGoogle WorkspaceDrive and Docs.
3. Click Sharing settings.
4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

   Supported editions for this feature: Business Standard and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Business; Nonprofits; Essentials.  Compare your edition

5. Click Sharing options. 
6. For Access Checker, choose an option: 
   • Recipients only, your organization, or public—Users can give access to anyone who has the link. The least restrictive setting, it’s available only if sharing is turned on for your organization and you allow users to publish files on the web.
   • Recipients only or your organization—Users can give access to required recipients and anyone in your organization who has the link.
   • Recipients only—Users can only give access to required recipients. If the file has been shared with other people, they still have access. This is the most restrictive setting.
7. Click Save. If you configured an organizational unit or group, you might be able to Inherit or Override a parent organizational unit, or Unset a group.

It can take up to 24 hours for changes to appear.

Control who can access files stored on shared drives

You can control who can move files and folders outside of your organization when moving content from:

• A shared drive in your organization to a shared drive owned by another organization or someone’s My Drive in another organization
• Someone’s My Drive in your organization to a shared drive owned by another organization 

For details on controlling who can access files stored on shared drives, go to Control sharing for your organization.

Related topics

• How Drive protects your privacy & keeps you in control
• Allow users to create shared drives
• Set target audiences for a Google service
• Add an organizational unit
• Move users to an organizational unit