Today, we're excited to announce the general availability of guest accounts in Google Workspace. Guest accounts empower organizations to securely collaborate with customers, partners, and vendors that are not on Google Workspace. More than secure, real-time messaging in Google Chat, guest accounts enable organizations to extend their security and data protection policies to these non-Workspace users. Whether it’s collaborating on a marketing brief in Google Docs or a presentation in Google Slides, non-Workspace users with guest accounts adhere to your organization’s security policies.
How it works
When an end user in your organization invites an external, non-Workspace user in Google Chat through a direct message (DM) or Chat Space, a guest account is provisioned for that external user within your Workspace domain with a unique account identifier. These guest accounts are also automatically placed in a dedicated "Workspace Guests" Organizational Unit (OU) in the Admin console, with
default security policies designed for these external users.
When communicating with guest accounts in DMs or Chat Spaces, your organization’s end users will see a teal “external” label for guest accounts. This is similar to the yellow “external” label that we have utilized in Google Chat to indicate external Workspace users. Guests can be @mentioned across supported Workspace app surfaces, similar to any other user. This means that end users can invite guests via Chat and collaborate with them using Chat, Drive, Docs, Slides, Sheets, and Meet.
Granular admin settings
Workspace admins have full visibility and control. The guest accounts capability is tied to your existing
external chat settings. If you have external chatting enabled, end users in your organization can now start inviting non-Workspace users in Chat to collaborate with you.
- Manage guest access settings: Manage who can invite guests to your organization.
- Manage guest lifecycle: View and manage all provisioned guest accounts in the admin console and through APIs.
- Policy enforcement: Guest accounts have a few default security settings that are not inherited from the Root OU. This helps organizations get started from a baseline security posture for guest accounts. View the defaults and apply your org specific policies to the "Workspace Guests" OU, such as 2-step verification or context-aware access.
Your organization retains full ownership of data created and shared within your Workspace domain when collaborating with users using guest accounts. Moreover, external users with guest accounts cannot create or own new files in Google Drive; they can only be invited to collaborate on existing files.
To learn more about the full set of capabilities for guest accounts and features available to host organization’s administrators to manage these guest accounts, take a look at the
detailed documentation.
Important notes
- Guest accounts are created only for non-Workspace external users. Functionality to collaborate with external Workspace users and consumer Google accounts remains unchanged and does not require guest account creation. API capability to create guests will be available in open beta by May 2026.
- If you use trusted domains to only allow sharing only with certain organizations outside of your business, you can now start adding non-Workspace domains to your allowlisted domains to start collaborating securely with non-Workspace domains. Note that setting up trusted domains prevents your organisation from collaborating with consumer Google accounts. This includes collaboration with non-Workspace users who may have created consumer Google accounts using their work email address.
- Guests are modelled as a type of user. In the Directory API, user.list will now include guests by default. The API now also includes a new field is_guest_user to identify guests. Guests will not be auto provisioned to existing 3P SAML apps that support automated user provisioning.
Getting started
- Admins:
- External chat settings: At launch, end users who can chat externally will be able to invite and collaborate with non-Workspace external users in Chat by default. You can control which users are allowed to chat externally using the existing external chat settings.
- Guest invitation setting: You can restrict who can invite guest accounts in your organization using the guest invitation setting. This defaults to ON for everyone who can chat externally in your organization.
- End users: End users who can collaborate externally and have been permitted by admins to invite end users will be able to invite and collaborate with non-Workspace external users in Chat using guest accounts.
- Guests: Non-Workspace external users will receive an email invitation to their primary email address when invited by the host organization. Guests can sign up to start collaborating. Guests have limited feature capabilities available, similar to Workspace external users.
Rollout pace
Availability
- Business: Business Starter, Standard, and Plus
- Enterprise: Enterprise Starter, Standard, and Plus
Resources
