# 17 Google Chat external containment

> v0.0.3 · role: Prevent · [policy: #15 · #19](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

Google Chat carries direct messages, spaces and file attachments to anyone outside the organisation, which makes it a parallel sharing channel the Drive clamp ([№13](drive-external-sharing.md)) never sees. This control confines external chat and spaces to allowlisted domains or turns them off, stops invites being auto-accepted, and blocks file sharing in external conversations. Chat history is aligned with Vault ([№30](vault-retention.md)) so what remains permitted is still discoverable.

Documentation: [Chatting with external users & guest accounts](https://knowledge.workspace.google.com/admin/chat/chatting-with-external-users)

## Caveats

- Turning external chat off does not delete existing external spaces, messages or memberships — already-invited outsiders keep their access while internal users lose access to those conversations, so enumerate and clean those up separately.
- Chat is a Drive-sharing bypass in users' minds — they will attach the file they could not share, so clamp both or neither.
- Chat DLP (№26) requires Enterprise Standard+, Frontline Standard+ or an Education edition — on other editions the domain allowlist is the only real containment.
- Allowlisted-domain trust is transitive in practice — you inherit the allowlisted partner's account hygiene along with their domain.

## Setup steps

1. Contain direct messaging with outsiders: either turn external chat off, or allow it only to explicitly allowlisted trusted domains. — `Apps › Google Workspace › Google Chat › External chat settings`

   Allow users to send messages outside your organization = Off; or On + 'Only allow this for allowlisted domains' = checked

   docs: [Control external Chat & spaces chat options](https://knowledge.workspace.google.com/admin/chat/control-external-chat-and-spaces-chat-options)

2. Do the same for spaces, and turn off auto-accept so an external invite is a deliberate decision. — `Apps › Google Workspace › Google Chat › External chat settings`

   - **External spaces** = restricted to allowlisted domains (setting available on Business Standard+, Enterprise Standard+, Enterprise Essentials+ and Nonprofits editions)
   - **'Auto-accept chat invites from familiar contacts'** = unchecked

   docs: [Control external Chat & spaces chat options](https://knowledge.workspace.google.com/admin/chat/control-external-chat-and-spaces-chat-options)

3. Restrict file sharing in external conversations so Chat cannot be used as an out-of-band exfil channel that bypasses the Drive sharing clamp ([№13](drive-external-sharing.md)). — `Apps › Google Workspace › Google Chat › Chat file sharing`

   External conversations: file sharing = No files; Internal: Images only / Allow all files per policy

   docs: [Control file sharing in Chat](https://knowledge.workspace.google.com/admin/chat/control-file-sharing-in-chat)

4. Confirm Chat history/retention is aligned with Vault ([№30](vault-retention.md)) so contained-but-permitted external chat is still discoverable. — `Apps › Google Workspace › Google Chat`

   History = On and not user-changeable, if your retention policy requires it — this governs direct and group messages only; space history is configured separately

   docs: [Turn chat history on or off for an organization](https://knowledge.workspace.google.com/admin/chat/turn-chat-history-on-or-off-for-an-organization)

## How to verify

1. From a test account, attempt to start a direct message with an external address — it should be refused or restricted to allowlisted domains exactly as configured.

## Settings screens

- Apps > Google Workspace > Google Chat > External chat settings (and Chat file sharing)
  - console: https://admin.google.com/ac/managedsettings/216932279217
  - screenshot: ../screenshots/admin.google.com/ac/managedsettings/216932279217.png