Google has added new admin controls in Google Workspace that let businesses decide how their staff handle calendar invitations from people outside the organisation, a common route for phishing and calendar spam.

• What it is: New Google Calendar settings in the Admin console giving administrators control over invitations from unknown or external senders.
• Who is affected: Any business using Google Workspace for email and calendar.
• What the risk is: Unsolicited calendar invites are a known phishing tactic, sometimes containing malicious links disguised as meeting details. Without admin controls, staff may accept these by default.
• What action is needed: We recommend Workspace admins review the new Calendar invitation settings and restrict how invites from unknown senders are handled for their organisation.

This is a straightforward setting to tighten and worth a few minutes of an admin time.