New admin controls for adding invitations to Google Calendar

Google Calendar users have three options for how event invitations are added to their calendar: auto-add invitations from everyone, auto-add invitations from known senders only, or add invitations only after the user responds in email. To date, administrators can only choose the default value for new users in their organization.

With this release, we’re expanding Calendar settings in the Admin console to offer organizations more granular controls on invitations. Administrators can now determine the invitation options available to end users, providing organizations more control over inbound event invitations from unknown senders and minimizing potential security risks from the content contained within them. While the existing capability only determined the default for new users, the new setting applies to new as well existing users.

Getting started

Admins: This control is set to “From everyone” by default and can be adjusted at the organizational unit (OU) or group level. Visit the Help Center to learn more about automatically adding events to calendars.
End users: Users can select the value in their Calendar settings within the boundaries set by their administrator. Visit the Help Center to learn more about managing invitations in Calendar.

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on August 14, 2026

Availability

Available to all Google Workspace customers

Resources

Google Workspace Admin Help: Automatically add events to calendars
Google Calendar Help: Manage invitations in Calendar

Google has expanded Google Workspace Admin Console settings to give administrators granular control over how inbound calendar invitations are added to user calendars. Previously, administrators could only set a single global default value for the entire organization. Now, they can establish specific boundaries on a per-department or per-group level to protect users from phishing links and spam distributed through unsolicited meeting requests. [1, 2]

What is Changing?

Administrators can now manage user privileges through two main mechanisms in the Admin Console: [1]

The “Least Restrictive Level” Boundary: Admins define the absolute maximum amount of freedom a user can have. If an admin restricts this to “Known Senders Only,” an end user cannot bypass company policy to select “From Everyone”. [3]
The Organization Default: Admins can set the default behavior for all new or unconfigured accounts while still leaving room for users to pick a stricter setting if the boundary allows. [3]

The Three Control Levels

Both administrators and end-users handle three distinct levels of invitation filtering: [1, 4]

From Everyone: All incoming event invites automatically populate on the calendar. [3, 5]
Only if the Sender is Known: Events are auto-added only if the sender belongs to the user’s primary domain, is saved in their contacts, or is someone they have previously interacted with via email. [3, 5]
When I Respond via Email: The invite does not appear on the calendar until the user manually accepts the invitation from their email inbox. [3, 6]

How to Configure the Settings

If you are a Workspace administrator with the Calendar administrator privilege, you can implement these boundaries by following these steps: [3]

Log into the Google Admin Console.
Navigate through the menu to Apps > Google Workspace > Calendar > Advanced Settings.
(Optional) Select a specific Organizational Unit (OU) or Configuration Group on the left panel if you only want to change rules for certain departments.
Locate the Least Restrictive Level Available section and choose the maximum ceiling option for your users.
Set the Default Value for automatic event additions.
Click Save (or Override if configuring an individual OU). [3]

Impact on End Users

New and Unmodified Accounts: Automatically inherit the newly established default and boundary guidelines.
Existing Custom Settings: If a user previously modified their own calendar settings, their choice remains active unless it violates the new “least restrictive level” established by the admin.
Application Scope: Changes only apply to future inbound invitations and will not alter events already on user schedules.
Default State: By default, the setting is deployed as “From Everyone,” meaning your system security posture will not change unless an administrator proactively modifies these fields. [2, 3, 4]