Modern Team Site - Allow Everyone Access to Site but Restrict Document Library Access?

Question

I have a Modern SharePoint Team site that has read permissions for the domain group "Everyone except external users" and edit permissions for specific groups. I have created several document libraries within this site and have done the usual when setting up permissions: stop inheriting, grant permissions, select AD group, select permission level, share. I managed to get a user that falls into the "Everyone except external users" group to test out the site. He was able to access the site AND the document libraries I thought I had locked down... I went back and checked the permissions and he shouldn't have had access.

Any ideas as to what setting I'm missing here? Or do Modern SharePoint site permissions always over-rule document library permissions (despite stopping the inherited permissions)?

Answer 1

If you go into one of the libraries and to the good old advanced permissions view you can use the "Check permissions" button in the ribbon and type in the user in question. This will tell you which group the user has access through.

The Office 365 group is automatically added into the SharePoint Groups, owners in the owner group - members and guests into the members group. It could be that one of these groups still have access to your library.