I have a Modern SharePoint Team site that has read permissions for the domain group "Everyone except external users" and edit permissions for specific groups. I have created several document libraries within this site and have done the usual when setting up permissions: stop inheriting, grant permissions, select AD group, select permission level, share. I managed to get a user that falls into the "Everyone except external users" group to test out the site. He was able to access the site AND the document libraries I thought I had locked down... I went back and checked the permissions and he shouldn't have had access.

Any ideas as to what setting I'm missing here? Or do Modern SharePoint site permissions always over-rule document library permissions (despite stopping the inherited permissions)?

1 Answer 1


If you go into one of the libraries and to the good old advanced permissions view you can use the "Check permissions" button in the ribbon and type in the user in question. This will tell you which group the user has access through.

The Office 365 group is automatically added into the SharePoint Groups, owners in the owner group - members and guests into the members group. It could be that one of these groups still have access to your library.

  • 1
    Excellent advise! I checked the user permissions and there it was: "Everyone except external users" sitting under the site members group... Something to look out for in the future. Thanks a bunch!
    – h_gator
    Mar 15, 2020 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.