16 Google Chat external containment

Caveats

• Turning external chat off does not delete existing external spaces, messages or memberships — already-invited outsiders keep their access while internal users lose access to those conversations, so enumerate and clean those up separately.
• Chat is a Drive-sharing bypass in users’ minds — they will attach the file they could not share, so clamp both or neither.
• Chat DLP (№28) requires Enterprise Standard+, Frontline Standard+ or an Education edition — on other editions the domain allowlist is the only real containment.
• Allowlisted-domain trust is transitive in practice — you inherit the allowlisted partner’s account hygiene along with their domain.

Setup steps

1. 1. Contain direct messaging with outsiders: either turn external chat off, or allow it only to explicitly allowlisted trusted domains.
   open ↗

   

   https://admin.google.com/ac/managedsettings/216932279217 · captured 2026-07-15

   Apps › Google Workspace › Google Chat › External chat settings

   Allow users to send messages outside your organization = Off; or On + 'Only allow this for allowlisted domains' = checked

2. 2. Do the same for spaces, and turn off auto-accept so an external invite is a deliberate decision.

   Apps › Google Workspace › Google Chat › External chat settings

   External spaces

   restricted to allowlisted domains (setting available on Business Standard+, Enterprise Standard+, Enterprise Essentials+ and Nonprofits editions)

   'Auto-accept chat invites from familiar contacts'

   unchecked

3. 3. Restrict file sharing in external conversations so Chat cannot be used as an out-of-band exfil channel that bypasses the Drive sharing clamp (№13).

   Apps › Google Workspace › Google Chat › Chat file sharing

   External conversations: file sharing = No files; Internal: Images only / Allow all files per policy

4. 4. Confirm Chat history/retention is aligned with Vault (№32) so contained-but-permitted external chat is still discoverable.

   Apps › Google Workspace › Google Chat

   History = On and not user-changeable, if your retention policy requires it — this governs direct and group messages only; space history is configured separately

How to verify

1. From a test account, attempt to start a direct message with an external address — it should be refused or restricted to allowlisted domains exactly as configured.