1

I have a new account in Office 365, but I need to remove its access to the tenant's SharePoint Online sites. I have already removed the SharePoint Online (Plan 1) feature from the license associated with the account, but this hasn't succeeded in removing the account's access.

A handful of the sites have the "Everyone Except External Users" group listed with some level of permission. That new account is able to access those sites from this group's access permissions, even though that account is no longer licensed for SharePoint Online. I'm wondering if there is a way to remove this account from the "Everyone Except External Users" group?

Improve this question

2 Answers 2

Reset to default
1

'Everyone except external' is a group built into the SharePoint codebase. You cannot modify membership as it doesn't actually have membership (and again, being part of the codebase rather than a modifiable object).

You could use Conditional Access Policies to control what the account can long into. As you've observed, removing the SPO license doesn't remove their access to SPO.

Improve this answer
4
  • As part of the testing, we unlicensed the account. Even unlicensed an internal user can access a SharePoint Online site from the permissions granted by that "Everyone Except External" group (including the files saved in the document library). I'll give the Conditional Access Policies a try to see if that fixes it.
    – Lewis O.
    Commented Sep 24, 2019 at 16:04
  • Yes, an unlicensed user does not remove access to SPO. It just means you're violating the license if that user uses SPO.
    – user6024
    Commented Sep 24, 2019 at 16:27
  • Sadly, to set up and use Condition Access Policies in Office 365 for SharePoint, our Azure AD requires a premium P1 or P2 license.
    – Lewis O.
    Commented Sep 24, 2019 at 17:42
  • That is correct. That is the only Microsoft-provided method you're going to accomplish what you're asking to do.
    – user6024
    Commented Sep 24, 2019 at 17:48
0

You can use the PowerShell to remove the External user completely .

Import-Module Microsoft.Online.Sharepoint.PowerShell -DisableNameChecking
$AdminSiteURL="SharePoint Tenant Admin URL"
$Cred = Get-Credential
Connect-SPOService -URL $AdminSiteURL -Credential $Cred
$ExternalUserID = "UserEmail.com"
$ExternalUser = Get-SPOExternalUser -SiteUrl -filter $ExternalUserID
Remove-SPOExternalUser -UniqueIDs @($ExternalUser.UniqueId) -Confirm:$falses
Improve this answer
1
  • Helpful, but the issue is that the user is internal. Is there an option for this?
    – Lewis O.
    Commented Sep 24, 2019 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.