17 Google Chat external containment

Google Chat carries direct messages, spaces and file attachments to anyone outside the organisation, which makes it a parallel sharing channel the Drive clamp (№13) never sees. This control confines external chat and spaces to allowlisted domains or turns them off, stops invites being auto-accepted, and blocks file sharing in external conversations. Chat history is aligned with Vault (№30) so what remains permitted is still discoverable.

Documentation: Chatting with external users & guest accounts ↗

Caveats

Turning external chat off does not delete existing external spaces, messages or memberships¹
Chat is a Drive-sharing bypass in users’ minds²
Chat DLP (№26) requires Enterprise Standard+, Frontline Standard+ or an Education edition³
Allowlisted-domain trust is transitive in practice⁴

Setup steps

open ↗
https://admin.google.com/ac/managedsettings/216932279217 · captured 2026-07-15
Apps › Google Workspace › Google Chat › External chat settings
Contain direct messaging with outsiders: either turn external chat off, or allow it only to explicitly allowlisted trusted domains.

Allow users to send messages outside your organization = Off; or On + 'Only allow this for allowlisted domains' = checked

Control external Chat & spaces chat options ↗
Apps › Google Workspace › Google Chat › External chat settings
Do the same for spaces, and turn off auto-accept so an external invite is a deliberate decision.

External spaces
restricted to allowlisted domains (setting available on Business Standard+, Enterprise Standard+, Enterprise Essentials+ and Nonprofits editions)
'Auto-accept chat invites from familiar contacts'
unchecked

Control external Chat & spaces chat options ↗
Apps › Google Workspace › Google Chat › Chat file sharing
Restrict file sharing in external conversations so Chat cannot be used as an out-of-band exfil channel that bypasses the Drive sharing clamp (№13).

External conversations: file sharing = No files; Internal: Images only / Allow all files per policy

Control file sharing in Chat ↗
Apps › Google Workspace › Google Chat
Confirm Chat history/retention is aligned with Vault (№30) so contained-but-permitted external chat is still discoverable.

History = On and not user-changeable, if your retention policy requires it — this governs direct and group messages only; space history is configured separately

Turn chat history on or off for an organization ↗

How to verify

From a test account, attempt to start a direct message with an external address — it should be refused or restricted to allowlisted domains exactly as configured.

v0.0.3Prevent policy #15 · #19 ↗