13 Drive external-sharing restriction / trust rules

Caveats

• Trust rules require Enterprise Standard/Plus, Education Standard/Plus, Frontline Plus or Enterprise…¹
• Turning external sharing fully Off also revokes external users’ access to previously shared items²
• Shared drives carry their own sharing settings, which can be looser than the OU default³
• Visitor sharing is a distinct toggle and a routine blind spot⁴

Setup steps

1. open ↗

   

   https://admin.google.com/ac/managedsettings/55656082996/sharing · captured 2026-07-15

   Apps › Google Workspace › Drive and Docs › Sharing settings › Sharing options ↗

   Select the OU (organizational unit), then set the outbound boundary. 'Off' is the honest default; 'allowlisted domains' is the usual compromise.

   Sharing outside of <domain>

   Off, or 'Allowlisted domains' with an explicit domain list

   Manage external sharing for your organization ↗

2. Apps › Google Workspace › Drive and Docs › Sharing settings › Sharing options

   Do not let the warning BE the boundary, and close visitor sharing: the warning stays ON as a speed bump for permitted external shares (it enforces nothing by itself), while non-Google visitor sharing quietly re-opens the boundary and goes OFF.

   Warn when sharing outside <domain> = On; Allow users or shared drives in <domain> to share items with guest accounts and visitors without Google Accounts = Off (visitor sharing)

   Allow sharing to non-Google users with visitor sharing ↗

3. Apps › Google Workspace › Drive and Docs › Sharing settings › Sharing options

   Set the default link state for newly created files so nothing is born public.

   When sharing outside of <domain> is allowed, users can make files and published web content visible to anyone = Off; General access default = Private to the owner

   Set general access sharing options for your organization ↗

4. open ↗

   

   https://admin.google.com/ac/targetaudiences · captured 2026-07-15

   Directory › Target audiences ↗

   Define a target audience narrower than the whole domain to allow sharing with specific teams.

   Create a target audience per department; set it as the Drive default rather than the whole organisation

   Create a target audience ↗ Set target audiences for a Google service ↗

5. open ↗

   

   https://admin.google.com/ac/dp · captured 2026-07-15

   Rules › Create rule › Trust rule ↗

   On Enterprise Standard/Plus, Education Standard/Plus, Frontline Plus or Enterprise Essentials Plus, replace the blunt allowlist with directional trust rules (who may share, to whom, in which direction).

   Create trust rules: internal→external sharing

   allow to named partner domains only, warn or block otherwise

   external→internal receiving

   allow from named partner domains only

   Create and manage trust rules for Drive sharing ↗

Ongoing maintenance

• requires a human Quarterly: review trust-rule exceptions and expire ones whose engagement ended.

How to verify

1. From a test account, share a document to a personal address outside the trust rules — the share should be blocked or warned exactly as configured.