Supported editions for this feature: Workspace guests in Google Chat are supported in all Business and Enterprise SKUs. Workspace guests in Gmail Client-side encryption are supported in Enterprise Plus SKUs with the Assured Controls add-on. Compare your edition
If your users will be collaborating only with external users that use Client-side Encryption (CSE), see Provide external access to client-side encrypted content.
What are guests?
Workspace guest accounts let people who don't have accounts within your organization—such as a contractor who uses a different email system—securely collaborate with your users in Google Workspace apps.
How guest accounts work
When someone in your organization sends an encrypted email or invites an external user to a chat, Google Workspace creates a guest account for them. The guest receives an invitation to set up their account. After the guest acknowledges the Google Workspace Terms of Service and that any data they access belongs to your organization, they can start working with your users.
Guests are automatically added to the Workspace Guests organizational unit of your Admin console, where you can manage their accounts. You can update their information, control which services they have access to, set password requirements, and use other security features. For added security, guest accounts cannot be moved into other organizational units.
What can guests do?
Workspace guests can view and respond to encrypted emails, join chats, access shared documents and drives, and participate in meetings as a guest in your organization.
Email capabilities for guests
|
Workspace user ability |
Supported for guests? |
|---|---|
|
Receive and reply to encrypted emails on external accounts |
Only with the Assured Controls Add-on |
Chat capabilities for guests
|
Workspace user ability |
Supported for guests? |
|---|---|
|
Create Space |
|
|
Browse Spaces |
Guests can only browse spaces they're added to by members of your organization |
|
Message Search |
Guests can search chats and Spaces they are in |
|
Request to Join Spaces |
|
|
Chat with external users in a DM |
|
|
Chat with internal users in a DM |
When sent a message request |
|
Chat with other guests in a DM |
Only with guests created by the same host domain |
|
Join a space marked as external created by an external organization |
|
|
Join a space marked as external created by an external organization |
When added by a user from your organization |
|
Join internal spaces |
|
|
Add others to a space |
|
|
Modify space details |
|
|
Use people suggestions |
Suggestions only include users who have messaged the guest |
|
Use @mention people suggestions in a Space |
Suggestions only include users who have messaged the guest |
|
Upload files to a space marked as external |
With administrator permission |
|
Upload files to a DM |
With administrator permission |
|
Access files uploaded to space marked as external |
|
|
Access files uploaded to DM |
|
|
View public spaces using a URL |
|
|
Be invited to multiple spaces |
|
|
Find, install, and run Chat apps |
|
|
Add Webhooks to spaces |
|
|
Initiate Meet requests |
|
|
Block users |
|
|
Report users |
|
|
Report messages in spaces |
|
|
React with emoji in spaces |
|
|
React with emoji in DMs with organization users |
|
|
React with custom emoji |
|
|
Create, assign, or mark a space task as completed |
|
|
Use @All in a space |
With Space Manager permission |
|
Pin a message, Google Docs file, or link to Chat Board |
Drive capabilities for guests
|
Workspace user ability |
Supported for guests? |
|---|---|
|
Read the name and description of a file or folder |
|
|
Read the content of a file |
|
|
Read the list of items in a folder |
|
|
Download a file |
|
|
Copy a file |
|
|
Add comments to a file |
|
|
Modify the name and description of a file or folder |
|
|
Modify the content of the file |
|
|
Access historical revisions |
|
|
Remove items from the My Drive folder |
|
|
Share items from the My Drive folder |
|
|
Share a shared drive item |
|
|
Share a Shared Drive folder |
|
|
Add files to shared drives |
|
|
Modify the name or description of a shared drive |
|
|
Add shared drive members |
|
|
Access detailed file permissions |
|
|
Reorganize items within a shared drive |
|
|
Move items outside of a shared drive |
|
|
Move items into the trash |
|
|
Recover items from the trash |
|
|
Empty the trash |
|
|
Delete a file or folder |
|
|
Delete items in shared drives |
|
|
Delete an empty shared drive |
Meet capabilities for guests
|
Workspace user ability |
Supported for guests? |
|---|---|
|
Join a Meet call from a Chat invite sent by an internal user |
Note: Guests don't have access to Gmail, Google Calendar or Gemini in Workspace. They can't be included in Dynamic Groups.
Guest account limits
You get 5 free guest accounts for every paid Business and Enterprise license in your organization. For example, if your organization has 10 paid user licenses, you can have 50 guest accounts.
Turn off guest account invitations
By default, your users can invite guests to your organization using Google Chat or Gmail Client-side Encryption (CSE). If you don't want your users to be able to invite guests, you can turn off guest account invitations in either Google Chat, Gmail CSE, or both.
Turn off guest account invitations in Chat
- Sign in with an administrator account to the Google Admin console.
- Go to Menu
Security 
Access and data
control External sharing Guest
invitations. - Clear Allow users to send guest invitations to people outside your organization.
- Click Save.
Turn off guest account invitations in Gmail
- Sign in with an administrator account to the Google Admin console.
- Go to Menu Data Compliance
Client-side encryption Gmail
Encryption with guest accounts.
- Clear Allow users to send client-side encrypted messages to recipients who aren't using S/MIME.
- Click Save.