I have a new Site and have "Everyone except external Users" in a Company Group (which I then apply to all of this site's Subsites with Read Permissions).
The default Members group grants
Edit permissions at the root Site level, which permits users to add Document Libraries (and other apps). When I go to the Permissions for the site, I am unable to change the Permission levels for the Members, Owner, and Visitor Groups from their defaults.
What is the best way to restrict our Users from manipulating the "root subsite" (since each department has a subsite where they are designated to do their thing).