Restrict the access users can give to files

This page is for administrators. To limit sharing of your own files, go here instead.

As an administrator, you can decide how much access users can give to files when they’re prompted to share a file. Users get prompted to share at the following times:

• Send Gmail or Google Chat messages with links to files that haven't been shared with recipients.
• @mention someone in a comment in a file who doesn't have access.
• Attach files to Google Calendar events and guests don't have access to the files.

When users share files that they don't own, the sharing options come from the file owner's organizational unit. When users share many files, the options come from the most restrictive organizational unit.

Set how much access users can give

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle WorkspaceDrive and Docs.

3. Click Sharing settings > Sharing options.

4. (Optional) To apply the setting only to some users, at the side, select an organizational unit (often used for departments) or configuration group (advanced). Show me how

   Group settings override organizational units. Learn more

5. For Access Checker, choose an option:
   • (Least restrictive) Recipients only, your organization, or public–Users can choose any sharing option, including giving access to anyone who has the link. This option is available only if external sharing is turned on for your organization and you allow users to publish files on the web.
   • (More restrictive) Recipients only or your organization–Users can give access only to specific recipients or anyone in your organization who has the link.
   • (Most restrictive) Recipients only–Let users give access only to specific recipients. If the file is shared with other people, those people still have access.
6. Click Save. Or, you might click Override for an organizational unit.

   To later restore the inherited value, click Inherit (or Unset for a group).

Changes can take up to 24 hours but typically happen more quickly. Learn more