Remove 'Everyone except external users' from sensitive sites and hide it in the people picker¶
Licence and role
Site access reviews and EEEU insights: SharePoint Advanced Management (included with Microsoft 365 Copilot licences). People picker setting: any SharePoint Online plan.
Why it matters¶
'Everyone except external users' (EEEU) gives every employee access in one click. On a sensitive site it means Copilot can use that content for anyone who asks. Microsoft's remediation step is to remove company-wide groups and links from overshared sites, starting with site access reviews.
Steps¶
- From the EEEU insights (CR01), start a site access review for each sensitive site so the site owner removes EEEU and company-wide links (SharePoint admin center > Reports > Data access governance > select the report > Initiate site access review).
- Where owners do not respond within the deadline, remove EEEU from the site permissions yourself and record it in the tracker.
- Hide the EEEU claim in the people picker so new grants are harder: Set-SPOTenant -ShowEveryoneExceptExternalUsersClaim $false (a tenant change; run it yourself after telling the helpdesk).
- Re-run the EEEU insights report after 28 days and compare.
Impact on users¶
People who relied on EEEU lose access to that site and may raise tickets. Hiding the claim does not remove existing EEEU grants; it only stops new ones from the people picker.
Rollback¶
Re-add the group to the site if a business need is confirmed (prefer a named group). Show the claim again with -ShowEveryoneExceptExternalUsersClaim $true.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Microsoft.Online.SharePoint.PowerShell (SharePoint settings), ExchangeOnlineManagement (audit).
Connect first:
Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
Connect-ExchangeOnline
Note: Microsoft retires Search-UnifiedAuditLog on 15 Oct 2027 (MC1505599). CR05 will move to the Graph AuditLogQuery API before then.
Get-SPOTenant | Select-Object ShowEveryoneExceptExternalUsersClaim, ShowAllUsersClaim, ShowEveryoneClaim | Format-List
How to verify¶
Sensitive sites from CR01 no longer grant EEEU; the next EEEU insights report shows fewer items; ShowEveryoneExceptExternalUsersClaim is False.
Sources¶
- Advanced management (Microsoft Learn)
- Configure secure governed data foundation Microsoft 365 Copilot (Microsoft Learn)
This control is in the M365 Copilot Readiness Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 24 controls.