Allow external sharing with only trusted domains

Supported for all Google Workspace, Cloud Identity, and G Suite editions except as noted

Let your users share only with certain organizations outside of your business or school. Add the organization's domain to your allowlist of trusted domains, and then choose sharing settings for your users.

Services that work with trusted domains

• Google Drive—Users can share files with domains on the allowlist.
• Classroom—When you put a domain on the allowlist, your users can join classes in that domain and users in the allowlisted domain can join your classes.
• Google Chat—Users in a trusted domain can chat with users in your organization. Depending on your Google Workspace edition, your users can create and join one-to-one messages or spaces that include users in a trusted domain. Not supported for Enterprise Starter.
• Looker Studio—Users in your organization can access assets from domains on the allowlist.

How the allowlist works

Expand section  |  Collapse all

Step 1: Add a trusted domain to your allowlist

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountDomainsAllowlisted domains.
3. Click Add domain.
4. Enter the domain, subdomain, or multiple domains separated by commas. You can add up to 200 domains at time. Domains must use Google Workspace. If they have Essentials, they must have verified their domain. 
5. Click Add. Repeat to add more domains.
6. Click Save.

Step 2: Review & troubleshoot trusted domain setup

You can check that the allowlisted domain is set up correctly and uses Google Workspace.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle WorkspaceDrive and Docs.
3. Click Sharing settingsSharing options.
4. For Allowlisted Domains, click View configured allowlisted domains.
5. If you get an Incompatible with allowlisted domains error, review Troubleshoot setup errors on this page.
6. If needed, remove any incompatible domains from your allowlist and add them again following the guidelines.

Troubleshoot setup errors

• The domain name is misspelled.
• The domain is a Google service account (domain name ends in gserviceaccount.com). Learn more
• For Drive files, the domain isn't using Google Workspace. To troubleshoot, follow the steps in Allow sharing to non-Google users with visitor sharing.
• The domain is using an email-verified Google Workspace Essentials edition. You can only use domain-verified editions in the allowlist.

Step 3: Set up sharing access for users

• For sharing in Drive, Docs, Sheets, Slides, and Sites, follow the steps in Allow external sharing with only certain domains.
• For Classroom, go to Grant file sharing access for domains on your allowlist.
• For Chat, follow the steps in Set up external Chat.
• For Looker Studio, go to Restrict sharing outside trusted domains.

Troubleshoot sharing errors

• Classroom—Sharing isn't available because the allowlisted domain isn't using Google Workspace Education Fundamentals or Google Workspace Education Plus.
• Chat—The domain is on the allowlist, but users can't create external spaces. If you checked the allowlisted domains box for Chat externally, you need to also check this box for spaces. ​Or the domain is using an email-verified Google Workspace Essentials edition. You can only use domain-verified editions in the allowlist.

Remove a domain from your allowlist

Remove the domain from your allowlist to stop sharing between your organization and the domain. Users don't get a notification about the change. When a domain is removed, users in that domain lose access to any shared files. The files are also removed from their Shared with me folder in Drive.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountDomainsAllowlisted domains.
3. Point to the domain name and click Remove.
4. Click Remove domain.