Back to Checks
googleworkspace

Users are warned when sharing files outside the domain

drive_external_sharing_warn_users
Service: driveSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

The domain-wide Drive and Docs configuration warns users when they attempt to share a file with users outside the organization. This prompt gives users an opportunity to reconsider before exposing organizational content to external parties, reducing the likelihood of accidental data disclosure through everyday sharing actions.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without external sharing warnings, users may unintentionally share sensitive documents with external recipients who are not entitled to the data. This is a common vector for inadvertent leakage of intellectual property, personally identifiable information, and confidential business data through routine Drive sharing.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks drive_external_sharing_warn_users

Recommendation

Enable external sharing warnings so users are notified whenever they attempt to share a file outside the organization. This simple prompt helps prevent accidental disclosure of sensitive content to unintended recipients.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Drive and Docs**
3Click **Sharing settings** > **Sharing options**
4Under **Sharing outside of <Company>**, ensure sharing outside the domain is allowed and check **For files owned by users in <Company> warn when sharing outside of <Company>**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.drive.drive_client import drive_client


class drive_external_sharing_warn_users(Check):
    """Check that users are warned when sharing files outside the domain

    This check verifies that the domain-level Drive and Docs policy warns
    users when they attempt to share a file with someone outside the
    organization, reducing the risk of accidental information disclosure.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if drive_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=drive_client.policies,
                resource_id="drivePolicies",
                resource_name="Drive Policies",
                customer_id=drive_client.provider.identity.customer_id,
            )

            warning_enabled = drive_client.policies.warn_for_external_sharing

            if warning_enabled is True:
                report.status = "PASS"
                report.status_extended = (
                    f"External sharing warnings for Drive and Docs are enabled "
                    f"in domain {drive_client.provider.identity.domain}."
                )
            elif warning_enabled is None:
                report.status = "PASS"
                report.status_extended = (
                    f"External sharing warnings for Drive and Docs use Google's "
                    f"secure default configuration (enabled) "
                    f"in domain {drive_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"External sharing warnings for Drive and Docs are disabled "
                    f"in domain {drive_client.provider.identity.domain}. "
                    f"Users should be warned when sharing files outside the organization."
                )

            findings.append(report)

        return findings

References