Back to Checks
googleworkspace

External spaces in Chat are restricted to allowed domains

chat_external_spaces_restricted
Service: chatSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:NotDefined

Google Chat external spaces allow users to create or join collaborative spaces that include people outside the organization. If external spaces are allowed, they can optionally be restricted to only allowlisted domains to limit external participation.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Unrestricted external spaces allow users to add anyone from any domain to persistent group conversations. This increases the risk of confidential information exposure in shared spaces and enables unauthorized external access to ongoing organizational discussions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks chat_external_spaces_restricted

Recommendation

Restrict external spaces to allowlisted domains only to control which external parties can participate in organizational Chat spaces.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Google Chat and classic Hangouts**
3Click **External Spaces**
4Set **Allow users to create and join spaces with people outside their organization** to **ON**
5Check **Only allow users to add people from allowlisted domains**
6Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.chat.chat_client import chat_client


class chat_external_spaces_restricted(Check):
    """Check that external spaces in Google Chat are restricted.

    This check verifies that external spaces are either disabled entirely
    or restricted to allowlisted domains only, preventing users from
    creating or joining spaces with unrestricted external participants.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if chat_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=chat_client.policies,
                resource_id="chatPolicies",
                resource_name="Chat Policies",
                customer_id=chat_client.provider.identity.customer_id,
            )

            spaces_enabled = chat_client.policies.external_spaces_enabled
            allowlist_mode = chat_client.policies.external_spaces_domain_allowlist_mode

            if spaces_enabled is False:
                report.status = "PASS"
                report.status_extended = (
                    f"External spaces are disabled "
                    f"in domain {chat_client.provider.identity.domain}."
                )
            elif allowlist_mode == "TRUSTED_DOMAINS":
                report.status = "PASS"
                report.status_extended = (
                    f"External spaces are restricted to allowed domains "
                    f"in domain {chat_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                if spaces_enabled is None and allowlist_mode is None:
                    report.status_extended = (
                        f"External spaces restriction is not explicitly configured "
                        f"in domain {chat_client.provider.identity.domain}. "
                        f"External spaces should be restricted to allowed domains only."
                    )
                else:
                    report.status_extended = (
                        f"External spaces are not restricted to allowed domains "
                        f"in domain {chat_client.provider.identity.domain}. "
                        f"External spaces should be restricted to allowed domains only."
                    )

            findings.append(report)

        return findings

References