# 16 Calendar external-sharing lockdown

> v0.0.4 · role: Prevent · [policy: #15 · #30](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

Calendar sharing publishes event detail — titles, attendees, locations — to whoever the user shares with, inside or outside the organisation. Restricting sharing to free/busy hides that content while leaving scheduling workable, and the guest warning tells a user before an invite exposes an event to outsiders. For a targeted-staff threat model a principal's meeting titles and attendee lists are intelligence, and so is a colleague's view of their movements — which is why the internal default matters too.

## Caveats

- Lowering the external sharing level can revoke access people outside the organization previously had to shared calendars — warn affected users before the change, and audit existing shares to confirm the clamp took effect.
- Free/busy still leaks a pattern of life — an adversary learns when a principal travels, when they are in back-to-back meetings, and when they are unreachable. It hides only content.
- Room and resource calendars are separate objects — they carry their own sharing settings and are routinely left wide open.
- Changes can take up to 24 hours to propagate — re-check the effective policy rather than trusting the console immediately after saving.

## Setup steps

1. Restrict what calendar detail leaks outside the organization. Free/busy-only is the CIS-aligned default; 'Share all information' publishes meeting titles, attendees and locations to anyone the user shares with. — `Apps › Google Workspace › Calendar › Sharing settings`

   - **External sharing options for primary calendars** = Only free/busy information (hide event details)

   docs: [Set Google Calendar sharing options](https://knowledge.workspace.google.com/admin/calendar/set-google-calendar-sharing-options)

2. Set the internal default too — a targeted-staff threat model does not want every colleague reading a principal's movements. — `Apps › Google Workspace › Calendar › Sharing settings`

   - **Internal sharing options for primary calendars** = Only free/busy information (users can still opt to share more)

   docs: [Set Google Calendar sharing options](https://knowledge.workspace.google.com/admin/calendar/set-google-calendar-sharing-options)

3. Turn on the external-guest warning (under External invitations on the Sharing settings screen) so users are told before an invite exposes an event to outside participants. — `Apps › Google Workspace › Calendar › Sharing settings`

   Warn users when inviting guests outside of the domain = On (checked)

   docs: [Allow external invitations in Google Calendar events](https://knowledge.workspace.google.com/admin/calendar/allow-external-invitations-in-google-calendar-events)

4. Confirm no calendar remains published to the public web — after lowering the external sharing level, audit existing shares to verify outsiders' access was actually removed. — `Apps › Google Workspace › Calendar › Sharing settings`

   Audit existing public calendars; revoke 'Make available to public'

## Ongoing maintenance

- **[automatable: script]** Quarterly: sweep for user calendars published to the public web.

## How to verify

1. From an external Google account, open a shared primary calendar of a test user — only free/busy should render, no event titles. Tests the real exposure with zero tenant access.

## Settings screens

- Apps > Google Workspace > Calendar
  - console: https://admin.google.com/ac/managedsettings/435070579839
  - screenshot: ../screenshots/admin.google.com/ac/managedsettings/435070579839.png
- Apps > Google Workspace > Calendar > Sharing settings
  - console: https://admin.google.com/ac/managedsettings/435070579839/sharing
  - screenshot: ../screenshots/admin.google.com/ac/managedsettings/435070579839/sharing.png
- Apps > Google Workspace > Calendar > General settings (secondary calendar sharing)
  - console: https://admin.google.com/ac/managedsettings/435070579839/general
  - screenshot: ../screenshots/admin.google.com/ac/managedsettings/435070579839/general.png