Google has added a new admin control that lets businesses limit who can send calendar invitations to staff, closing off a growing phishing entry point.

• What it is: A new Google Admin Console setting under Calendar controls who can invite your users to events, from everyone to only people inside your organisation or trusted domains.
• Who is affected: Any business using Google Workspace for Calendar. The default setting still allows invites from anyone, including unknown senders.
• What the risk is: Calendar invites from strangers are a growing phishing tactic, since invite descriptions and links often land straight in a user's calendar and bypass email spam filters.
• What to do: Review this setting in the Admin Console and restrict invitations to internal or trusted senders where practical.

This is a quick change that meaningfully closes off a phishing avenue most businesses have not considered.