External group sharing

Type: external_group_sharing
Category: Sharing
Enforced at: Authoring-time
Tiers: OrgIntegration
Enforcement: Enforce
Default: Not configured — member proposals are allowed and external organizations are not.

A group is owned by one home organization and becomes usable elsewhere through a link. This policy decides whether this organization accepts such rosters at all. The two flags are separate because they are different trust decisions: a household roster lives in a resident personal workspace, which is technically another organization, so accepting residents’ families and accepting an unrelated company roster must not be the same setting. member_proposals is checked when a resident proposes a household to a site (org-tree and that site’s integration rows); external_orgs is checked when a group share offer is redeemed (org-tree rows only, so external_orgs can only be set on an organization policy). require_admission_approval and max_members limit each link for its whole life, not just when it is created: they are checked when a household is proposed or an offer redeemed, when an administrator changes the link’s admission mode, and every time a member is admitted — manually, on accept or re-sync, or automatically when someone joins the roster. A household link remembers the site it was proposed through, so that site’s integration rows keep binding it after acceptance; a link created by redeeming an offer has no site, so only org-tree rows bind it. The home organization’s own link is not a shared roster and is never limited.

When it is enforced

Evaluated when someone creates or updates an invitation, hold, or share. Requests that would exceed the limit are rejected — they are not silently rewritten.

Where to set it

Settings → Policies (org) or the integration Policies tab.

Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.

Arguments

The config object on create/update. Row fields outsideconfig are enforcement (this type acceptsenforce; any other value is rejected with 400), enabled (disabled rows never apply), and capability.

Name	Type	Required	Values	Description
member_proposals	string	No	allowdeny	Whether a member of this organization may propose their own household roster to a site. When denied, the resident interface does not offer it at all. Default: allow
external_orgs	string	No	allowdeny	Whether rosters owned by another real organization may be linked here. Organization policies only. Default: deny
require_admission_approval	boolean	No	—	When true, every member must be admitted by an administrator: the link cannot be switched to auto or pinned mode, and members of a link already in auto mode are recorded as pending instead of admitted. Default: false
max_members	integer	No	—	Cap on admitted members per link; a positive integer. A proposal or offer whose roster is already larger is refused, admitting a member past the cap is refused, and automatic admission stops at the cap and leaves later members pending. Denying a member is never capped.

How overlapping rows combine

member_proposals: any deny row wins. external_orgs: opt-in — any allow row allows. require_admission_approval: any row requiring it wins. max_members: the smallest value across all applicable rows wins. A policy load failure denies member_proposals and external_orgs, and refuses the operation when a limit has to be checked.

Example

Residents can bring a household of up to eight people, each admitted by an administrator, but no unrelated company roster can be linked.

{
  "member_proposals": "allow",
  "external_orgs": "deny",
  "require_admission_approval": true,
  "max_members": 8
}

Integrations

This type is documented on these connectors:

Virtual Access (virtual_access)
Virtual Demo Devices (virtual_demo)

Policy catalog
Policies architecture guide
No transitive delegation (no_transitive_delegation)
No invitation re-share (invitation_no_reshare)
User sharing control (user_sharing)