Drive Sharing Setting: Distributing content outside of your organization

[jones_matt]

Goal: We have a partner (external) organization with a Shared Drive that would like certain users to add files during a particular project. Our current settings are disallowing this as intended because currently "Distributing content outside of [your organization]" is set to "No one." At least for a short time I need to allow these users to put files in the external Shared Drive.

1. What are the most restrictive settings required to achieve our goal? Currently my idea is to make a group, and set the "Distributing content outside of [your organization]" to the value "Only users in [your organization]" for only that group. I think this would make exfiltrating files trivial, even to personal Google accounts.

2. Does anyone have clarity on the impact of the options for "Apps > Google Workspace > Drive and Docs > Sharing settings > Sharing options > Distributing content outside of [your organization]?" In particular, the documentation is pretty bad on the differences between "Anyone" and "Only users in [your organization]." What is the true difference between those two options? Source: https://support.google.com/a/answer/7662202#control_sharing_for_your_organization

Note: Adding the partner organization's domain to the Drive's Sharing settings > Alllowlisted Domains didn't help, sadly.

[cryptochrome · Accepted solution]

What this setting does, in general, is allow users to transfer files from internal shared drives to external Google Drive folder or shared drives (think of copying files from your Shared Drive to the Shared Drive of a client). 

The difference between "Anyone" and "only users in your organization" is that "Anyone" really means anyone. Example: You have given access to your Shared Drive to an external party (e. g. invited a partner or client to the Shared Drive). If the option is set to "Anyone", they would be allowed to "distribute" your content. When set to "Only users in your organization", these external users would not be able to distribute your content. 

I hope this makes sense. 

[jones_matt]

Thank you so much! That makes perfect sense. "Only users in your organization" seems like the most secure choice for my situation.

[cryptochrome]

Yes, especially if you enable this just for a hand full of users (through a group), as you described. 

[agibbons]

I really appreciate your clarifying the difference between "anyone" and "only users in your organization" here!

I was told by Google Support that to turn on Visitor Sharing (FYI the documentation online is still incorrect...) that I have to both allow the highest level of Access Checker (Recipients only, suggested target audience, or public (no Google account required)) AND have to set "Distributing content outside of <business>" to ANYONE.

We really only want to allow outside collaborators without a Google account to have visitor access to simply collaborate on/edit a shared doc. We do not, ideally, want them to ALSO be able to distribute/share the files. 

Anyone have a workaround or solution that satisfies these parameters?

[icrew]

It's possible for folks to create a (free) Google account that uses their existing non-Google, non-Gmail email address. See the "Use an existing email address" section of https://support.google.com/accounts/answer/27441?hl=en#:~:text=Use%20an%20existing%20email%20address... for all the details.

This is conceptually no different that needing to create a Dropbox account to be able to access Dropbox, or a Facebook account to access Facebook, or whatever. Unless the user is logging in, there's absolutely no way to tell whether they're the user that should have access to a particular piece of content.

Hope that helps,

Ian

[christiannewman]

Could you add shortcuts to the external shared drive instead of moving the files?

[jones_matt]

I appreciate the suggestion! I rushed to test this out since it's such a graceful solution, but sadly it doesn't work. Even though shortcuts don't appear to have owners, it wouldn't let me create or move a shortcut into the external Shared Drive. Allowing "Distributing content outside" allows a shortcut to be made, but with that enabled you can put a full file there too.