Back to Checks
googleworkspace

Default permission to view conversations is set to all group members

groups_view_conversations_restricted
Service: groupsSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:NotDefined

Google Groups for Business conversation viewing controls who can see group conversations by default. Restricting this to group members only ensures that conversations are visible only to participants, not all users in the organization or external parties.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Allowing all organization users or anyone to view group conversations can lead to information disclosure of sensitive discussions, internal decisions, and confidential data shared within groups.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks groups_view_conversations_restricted

Recommendation

Set the default permission to view conversations to all group members to ensure group discussions are only visible to their participants.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Groups for Business**
3Click **Sharing options**
4Set **Default for permission to view conversations** to **All group members**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.groups.groups_client import (
    groups_client,
)


class groups_view_conversations_restricted(Check):
    """Check that the default permission to view conversations is set to All Group Members.

    This check verifies that the domain-level Groups for Business policy
    restricts conversation viewing to group members only, preventing
    broader access by all organization users or anyone.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if groups_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=groups_client.policies,
                resource_id="groupsPolicies",
                resource_name="Groups Policies",
                customer_id=groups_client.provider.identity.customer_id,
            )

            view_access = groups_client.policies.view_topics_default_access_level
            domain = groups_client.provider.identity.domain

            if view_access == "GROUP_MEMBERS":
                report.status = "PASS"
                report.status_extended = (
                    f"Default permission to view conversations is set to "
                    f"all group members in domain {domain}."
                )
            elif view_access is None:
                report.status = "FAIL"
                report.status_extended = (
                    f"Default permission to view conversations uses Google's default "
                    f"configuration (all organization users) in domain {domain}. "
                    f"It should be restricted to all group members only."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Default permission to view conversations is set to "
                    f"{view_access} in domain {domain}. "
                    f"It should be restricted to all group members only."
                )

            findings.append(report)

        return findings

References