16 Calendar external-sharing lockdown

Calendar sharing publishes event detail — titles, attendees, locations — to whoever the user shares with, inside or outside the organisation. Restricting sharing to free/busy hides that content while leaving scheduling workable, and the guest warning tells a user before an invite exposes an event to outsiders. For a targeted-staff threat model a principal's meeting titles and attendee lists are intelligence, and so is a colleague's view of their movements — which is why the internal default matters too.

Caveats

Lowering the external sharing level can revoke access people outside the organization previously…¹
Free/busy still leaks a pattern of life²
Room and resource calendars are separate objects³
Changes can take up to 24 hours to propagate⁴

Setup steps

open ↗
https://admin.google.com/ac/managedsettings/435070579839 · captured 2026-07-15
Apps › Google Workspace › Calendar › Sharing settings
Restrict what calendar detail leaks outside the organization. Free/busy-only is the CIS-aligned default; 'Share all information' publishes meeting titles, attendees and locations to anyone the user shares with.

External sharing options for primary calendars
Only free/busy information (hide event details)

Set Google Calendar sharing options ↗
open ↗
https://admin.google.com/ac/managedsettings/435070579839/sharing · captured 2026-07-15
Apps › Google Workspace › Calendar › Sharing settings
Set the internal default too — a targeted-staff threat model does not want every colleague reading a principal's movements.

Internal sharing options for primary calendars
Only free/busy information (users can still opt to share more)

Set Google Calendar sharing options ↗
open ↗
https://admin.google.com/ac/managedsettings/435070579839/general · captured 2026-07-15
Apps › Google Workspace › Calendar › Sharing settings
Turn on the external-guest warning (under External invitations on the Sharing settings screen) so users are told before an invite exposes an event to outside participants.

Warn users when inviting guests outside of the domain = On (checked)

Allow external invitations in Google Calendar events ↗
Apps › Google Workspace › Calendar › Sharing settings
Confirm no calendar remains published to the public web — after lowering the external sharing level, audit existing shares to verify outsiders' access was actually removed.

Audit existing public calendars; revoke 'Make available to public'

Ongoing maintenance

automatable: script Quarterly: sweep for user calendars published to the public web.

How to verify

From an external Google account, open a shared primary calendar of a test user — only free/busy should render, no event titles. Tests the real exposure with zero tenant access.

v0.0.4Prevent policy #15 · #30 ↗