Back to Checks
googleworkspace

External Chat messaging is restricted to allowed domains

chat_external_messaging_restricted
Service: chatSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:NotDefined

Google Chat external messaging controls whether users can send messages to people outside the organization. If external messaging is allowed, it can optionally be restricted to only allowlisted domains to limit the scope of external communication.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Unrestricted external messaging allows users to communicate freely with any external party, increasing the risk of data exfiltration through conversation content and social engineering attacks from untrusted domains targeting internal users.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks chat_external_messaging_restricted

Recommendation

Restrict external Chat messaging to allowlisted domains only to limit information flow to trusted parties and reduce exposure to external threats.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Google Chat and classic Hangouts**
3Click **External Chat Settings**
4Select **Chat externally**
5Set **Allow users to send messages outside the organization** to **ON**
6Check **Only allow this for allowlisted domains**
7Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.chat.chat_client import chat_client


class chat_external_messaging_restricted(Check):
    """Check that external Chat messaging is restricted to allowed domains.

    This check verifies that external Chat messaging is either disabled
    entirely or restricted to allowlisted domains only, preventing
    unrestricted communication with external users.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if chat_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=chat_client.policies,
                resource_id="chatPolicies",
                resource_name="Chat Policies",
                customer_id=chat_client.provider.identity.customer_id,
            )

            allow_external = chat_client.policies.allow_external_chat
            restriction = chat_client.policies.external_chat_restriction

            if allow_external is False:
                report.status = "PASS"
                report.status_extended = (
                    f"External Chat messaging is disabled "
                    f"in domain {chat_client.provider.identity.domain}."
                )
            elif allow_external is None and restriction is None:
                report.status = "PASS"
                report.status_extended = (
                    f"External Chat messaging uses Google's secure default "
                    f"configuration (disabled) "
                    f"in domain {chat_client.provider.identity.domain}."
                )
            elif restriction == "TRUSTED_DOMAINS":
                report.status = "PASS"
                report.status_extended = (
                    f"External Chat messaging is restricted to allowed domains "
                    f"in domain {chat_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"External Chat messaging is not restricted to allowed domains "
                    f"in domain {chat_client.provider.identity.domain}. "
                    f"External messaging should be restricted to allowed domains only."
                )

            findings.append(report)

        return findings

References