Back to Checks
googleworkspace

External invitation warnings are enabled for Google Calendar

calendar_external_invitations_warning
Service: calendarSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

The domain-wide Google Calendar configuration warns users when they invite guests from outside the organization to an event. This prompt gives users a chance to reconsider before sharing meeting details with external parties, reducing the likelihood of accidental information disclosure through calendar invitations.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without external invitation warnings, users may unintentionally include external guests in internal meetings, exposing confidential meeting details, agendas, and internal attendee lists to unauthorized parties. This is a common vector for inadvertent data leakage through everyday calendar actions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks calendar_external_invitations_warning

Recommendation

Enable external invitation warnings so users are notified whenever a meeting invitation includes guests outside the organization. This simple prompt helps prevent accidental disclosure of meeting details to unintended recipients.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Calendar**
3Click **Sharing settings**
4Under **External invitations**, check **Warn users when inviting guests outside of the domain**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.calendar.calendar_client import (
    calendar_client,
)


class calendar_external_invitations_warning(Check):
    """Check that external invitation warnings are enabled for Google Calendar

    This check verifies that the domain-level policy warns users when they
    invite guests from outside the organization, reducing the risk of accidental
    information disclosure through calendar events.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if calendar_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=calendar_client.policies,
                resource_id="calendarPolicies",
                resource_name="Calendar Policies",
                customer_id=calendar_client.provider.identity.customer_id,
            )

            warning_enabled = calendar_client.policies.external_invitations_warning

            if warning_enabled is True:
                report.status = "PASS"
                report.status_extended = (
                    f"External invitation warnings for Google Calendar are enabled "
                    f"in domain {calendar_client.provider.identity.domain}."
                )
            elif warning_enabled is None:
                report.status = "PASS"
                report.status_extended = (
                    f"External invitation warnings for Google Calendar use Google's "
                    f"secure default configuration (enabled) "
                    f"in domain {calendar_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"External invitation warnings for Google Calendar are disabled "
                    f"in domain {calendar_client.provider.identity.domain}. "
                    f"Users should be warned when inviting guests outside the organization."
                )

            findings.append(report)

        return findings

References