In Google Workspace, set Drive external sharing at the organizational unit or group level, not once for everyone. Turn external sharing off for units that never need it, use allowlisted domains for partners, keep the external warning indicator on, and put shareable content in a shared drive tied to a unit that allows it.
Where it lives and how it applies
The settings are in the Admin console under Apps, Google Workspace, Drive and Docs, Sharing settings. You need the Drive and Docs administrator privilege. You can apply them per organizational unit or per group, and group settings override unit settings. Changes can take up to 24 hours.
That structure is the main tool. Do not pick one policy for the company. Pick one per kind of work.
The main switch
When external sharing is on, you can add limits such as warning users before they share or blocking link sharing. When it is off, users cannot share invitations, Drive links or attachments with outsiders, and external users lose access to items already shared with them. Know that second part before you flip it.
You can also block content from outside being shared with your users.
Allowlisted domains
An allowlist limits sharing to trusted domains. Recipients must be Google Workspace domains unless visitor sharing is enabled. Google notes you cannot pick individual allowlisted domains for this setting, since all trusted domains are included, and sharing with personal accounts is blocked.
Visitor sharing
Visitor sharing lets people without Google Accounts receive access. You can allow it for anyone or for trusted domains only. It is configured on a separate page, so check it separately even if your main sharing setting looks tight.
Warnings and visibility
The external warning indicator is on by default for files owned by or shared with outsiders. Keep it on. Even if you turn it off, you can still review external sharing in Drive log events.
Use shared drives as the boundary
Google describes a common approach: create a shared drive and assign it to an organizational unit that has external sharing enabled, rather than loosening sharing everywhere. You can also block moving content between a shared drive and an external shared drive or an external user's My Drive.
A starting configuration
- External sharing off for finance, HR and engineering units that hold source material.
- Allowlisted domains for the unit that works with partners.
- Visitor sharing off unless a team needs it, then only for trusted domains.
- Warning indicator on everywhere.
- A named shared drive for external collaboration with an owner.
Trust rules are a finer tool but exist only in certain editions, so check your edition before planning around them.
Safeguard's compliance automation can capture these settings as evidence each review period.
Quick check
If I turn external sharing off, what happens to files already shared?
External users lose access to items already shared with them.
Do group settings or organizational unit settings win?
Group settings override organizational unit settings.
Sources
Last reviewed: 19 October 2026.
