Back to Checks
googleworkspace

External sharing for primary calendars is restricted to free/busy only

calendar_external_sharing_primary_calendar
Service: calendarSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

The domain-wide default for primary calendars shares only free/busy information with external users. When external sharing is set to share full event details, sensitive information such as meeting titles, attendees, locations, and descriptions is exposed to users outside the organization.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Overly permissive external sharing of primary calendars exposes sensitive meeting metadata — titles, attendees, locations, and descriptions — to users outside the organization. This increases the risk of information disclosure, social engineering, and targeted phishing based on insights into organizational activities.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks calendar_external_sharing_primary_calendar

Recommendation

Restrict external sharing of primary calendars to free/busy information only. This preserves scheduling functionality with external users while preventing exposure of sensitive meeting details.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Calendar**
3Click **Sharing settings**
4Under **External sharing options for primary calendars**, select **Only free/busy information (hide event details)**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.calendar.calendar_client import (
    calendar_client,
)


class calendar_external_sharing_primary_calendar(Check):
    """Check that external sharing for primary calendars is restricted to free/busy only

    This check verifies that the domain-level policy for primary calendar external
    sharing is set to share only free/busy information, preventing exposure of
    event details to external users.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if calendar_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=calendar_client.policies,
                resource_id="calendarPolicies",
                resource_name="Calendar Policies",
                customer_id=calendar_client.provider.identity.customer_id,
            )

            sharing = calendar_client.policies.primary_calendar_external_sharing

            if sharing == "EXTERNAL_FREE_BUSY_ONLY":
                report.status = "PASS"
                report.status_extended = (
                    f"Primary calendar external sharing in domain "
                    f"{calendar_client.provider.identity.domain} is restricted to "
                    f"free/busy information only."
                )
            elif sharing is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Primary calendar external sharing uses Google's secure default "
                    f"configuration (free/busy only) "
                    f"in domain {calendar_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Primary calendar external sharing in domain "
                    f"{calendar_client.provider.identity.domain} is set to {sharing}. "
                    f"External sharing should be restricted to free/busy information only."
                )

            findings.append(report)

        return findings

References