Summary
Summary
- Google Workspace admins can now prevent users from automatically adding Calendar invitations from unknown senders.
- The change helps reduce unwanted calendar clutter and phishing attempts disguised as legitimate events or reminders.
- The new controls only affect future invitations and are rolling out to all Google Workspace customers. At long last, Google is making it harder for random people to add unwanted events directly to your Calendar. Until now, you could change the settings Google Workspace administrators set for how invitations were added to Calendars. Now, Google’s Workspace update lets admins limit which invitation settings you can choose from, closing the odd gap in the old system, where anyone could change default calendar settings to accept invitations from everyone. Google Calendar currently gives you three choices. You can automatically add invitations from everyone, add invitations only from known senders, or wait until they respond to an invitation by email before adding it to your calendar; all of which are explained in Google’s Official Workspace Documentation. Why Google Calendar restrictions matter Random calendar invites could do more harm than just clutter Calendar spam has been around for years; we have previously covered how to stop spam invites from appearing in Google Calendar. While an unwanted calendar event is annoying on its own, letting invitations from unknown senders automatically appear can also create a security problem. The bigger concern is that a calendar entry can contain phishing links, descriptions, CTAs, and other convincing event details that encourage people to interact with them. What might seem like a regular invitation link could potentially put the entire team’s security at risk if clicked. Attackers have already used Google Calendar invitations in phishing and spoofing campaigns, including attacks designed to make malicious invitations look like they came from legitimate senders. Even something as inconspicuous as a renewal warning showing up as a Calendar event could be an effective phishing attempt disguised as an ordinary reminder. That makes this new setting particularly useful for businesses, schools, and other organizations where an administrator may not want security to depend on every employee configuring Calendar correctly. An admin could, for example, prevent users from choosing “Invitations from everyone,” while still allowing them to choose between known senders and invitations they have explicitly responded to. It’s only for managed Workspaces, though Personal accounts are still vulnerable However, if you use a personal Google account rather than one managed through Google Workspace, this update doesn’t change anything for you. There is no administrator deciding which options you can use, so you still have direct control over how Calendar handles incoming invitations. You can find the setting by opening Google Calendar on a computer and heading to Settings > Event settings > Add invitations to my calendar. If spam is your main concern, choosing “Only if the sender is known” is good practice to avoid unwanted invites piling up on your calendar. The new controls started rolling out on August 14 and may take up to 15 days to appear. Google also says the changes affect only future invitations, so unwanted events already on your calendar will not disappear automatically.