We usually grant "Everyone except external user" read access to almost all SharePoint sites/.. and today we got a request from our customer that certain users which are defined inside the "Everyone except external user" should not access SharePoint, because they are actually external business consultants but defined as internal users.. so my question is that if we can prevent certain internal users from accessing SharePoint sites, even if we use the "Everyone Except external users" group to grant all internal users access to the site?

1 Answer 1


You would need to use Conditional Access Policies, created in Azure AD, at the site level. You can use Set-SPOSite -ConditionalAccessPolicy <policy_name> to assign it.

This will require Azure AD P1 licensing for users managing the policy and the end users who are covered by the policy.

  • so i need to run this script for each site?
    – John John
    Commented Apr 13, 2021 at 16:27
  • That's correct.
    – user6024
    Commented Apr 13, 2021 at 16:30
  • and what will happen to newly created sites? should we run the script on them, or can we define that any new site will automatically use the Conditional Access Policiy?
    – John John
    Commented Apr 13, 2021 at 16:33
  • 1
    You will need to run the script on new sites, as well. You could develop a Site Design + Flow/Logic App + PowerShell (i.e. Azure Automation) to set this on site creation.
    – user6024
    Commented Apr 13, 2021 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.