Handling With Everyone Except External Users During ODFB Migration

In this blog, you will learn about handling everyone except external users during ODFB Migration.

Introduction 

 

Hi guys, let's try to learn the most important aspects of handling everyone except the External Users domain group, which gets access by default and can't be deleted. There is an issue with security and compliance terms with most of our Business clients.

 

Following are different ways to handle this:

 

Option 1 - New option to govern access for external users

 

Use the following guidelines to grant access to external users for the selected groups.

 

NEW OPTION TO GOVERN ACCESS FOR EXTERNAL USERS
Group claim	Procedure	Result
Everyone	Configure your tenant to grant the Everyone claim to external users by running the Set-SPOTenant -ShowEveryoneClaim $true Windows PowerShell cmdlet.	External users who are granted the Everyone claim have access to content that is shared with the Everyone group.
All Authenticated Users and All Forms Users	Configure your tenant to grant the All Authenticated Users and All Forms Users claims to external users by running the Set-SPOTenant -ShowAllUsersClaim $true Windows PowerShell cmdlet	External users who are granted the All Authenticated Users and All Forms Users claims have access to content that is shared with the All Authenticated Users and All Forms Users groups.

 

PS script to do make the necessary change: Set-SPOTenant - ShowEveryoneClaim$false [For restricting as per our requirement]

Set-SPOTenant -ShowEveryoneClaim$true [Available By default for allowing]

 

Complete Reference

 

Option 2

 

Go to Site Settings >> Site Permissions >> Check all the 3 Groups Visitors/Members/Owners etc. if Everyone except external users is available >> Remove this Account from the Group >> Share/Save

 

The above process is applicable for all SP Site collections. We can project the same idea on the Tenant portal if feasible.

 

Option 3

 

If we do this for the tenants, it has to reflect across all the One Drive Sites & SP Sites too!

#SharePoint Online Admin Center URL
$AdminURL = "https://<Tenant>-admin.sharepoint.com"
#Connect to SharePoint Online
Connect - SPOService - url $AdminURL - credential(Get - Credential)
#Disable EveryoneExceptExternalUser & Everyone groups
Set - SPOTenant - ShowEveryoneExceptExternalUsersClaim $False
Set - SPOTenant - ShowEveryoneClaim $false

Please try the above script. If it's not sufficient, I will give you per One Drive Site removing User Account!!

 

Option 4

 

Remove users from a Hub Site Collection and it's associated sites in all the SharePoint Groups.

 

We can replace a Hub Site collection with a One drive site collection too using the below PS script.

cls
$tenantAdmin = https: //<TenantName>-admin.sharepoint.com/
    $hubSite = “ODFB User Site”
Connect - PnPOnline - Url $tenantAdmin - UseWebLogin
$HubSite = Get - PnPHubSite $hubSite
$HubSiteId = $HubSite.SiteId
$ModernSites = (Get - PnPTenantSite - Template 'GROUP#0') + (Get - PnPTenantSite - Template 'SITEPAGEPUBLISHING#0')
$SitesFromHub = New - Object System.Collections.ArrayList
Write - Host("Searching {0} sites:" - f $HubSite.Title) - BackgroundColor Gray
foreach($ModernSite in $ModernSites) {
    $site = Get - PnPHubSite $ModernSite.Url
    if ($site.SiteUrl) {
        if ($site.SiteId - eq $HubSiteId) {
            Write - Host("* {0} - {1}" - f $ModernSite.Title, $ModernSite.Url)
            $SitesFromHub.Add($ModernSite) | Out - Null
        }
    }
}
Write - Host ""
Write - Host "Adding Users:" - BackgroundColor Gray
foreach($SiteHub in $SitesFromHub) {
    Write - Host("* {0} - {1} ... " - f $SiteHub.Title, $SiteHub.Url)
    #Write - Host("* {0} - {1} ... " - f $SiteHub.Title, $SiteHub.Url) - NoNewline
    Connect - PnPOnline - Url $SiteHub.Url - UseWebLogin
    try {
        $group = Get - PnPGroup - AssociatedMemberGroup
        #Get - PnPGroupPermissions - Identity $group
        Remove - PnPUserFromGroup - LoginName < Everyone except external users
        @tenant.com > -GroupName $group
        Remove - PnPUserFromGroup - LoginName < Everyone @tenant.com > -GroupName $group
        #You can Remove more valid Users in the same above kind of syntax
        Write - Host "User(s) Removing Done to the:"
        $group.LoginName - BackgroundColor Magenta
        #Get - PnPGroupMembers - Identity $group
        #Get - PnPGroupPermissions - Identity $group
    } catch {
        Write - Host $_.ToString() - BackgroundColor Red
    }
}
Write - Host "All Done"
Write - Host "Press any key to Close..."
$Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")

Option 5 - Everyone except external users

 

All users added to your organization automatically become members of "Everyone except external users". Please note that you cannot change default permissions granted to "Everyone except external users" on Microsoft 365 group-connected team sites. If a group-connected team site is set to "Public," "Everyone except external users" has a default permission level of "Edit." When a group-connected team site is set to "Private," "Everyone except external users" can't be granted any permission to the site. Although the "Site permissions" tab will allow modifications to be granted, a background job will block such modifications to take effect. To change the privacy setting for a group-connected team site, select the Settings icon, and then select Site information. For a full reference, please check here.

 

More References

• https://sharegate.com/blog/sharepoint-security-groups
• https://blog.stealthbits.com/open-access-in-sharepoint-what-it-is-and-how-to-find-it/

Conclusion

 

Thus, we can use any of the above options that suit your business needs or requirements.

 

Happy ODFB management! Sharing is caring!!