Edit permissions for external users not working as expected

Question

I have a Modern Site connected to a M365 Group. Aside from the site owners, I want everyone else to only have Read permissions to everything (unless otherwise specified, per-list/library and per-document). "Everyone else" will almost always be external users to the tenant, granted access through invitation.

When the default Site Members group has Edit permissions, these external users - who are part of the Site Visitors group - still has the ability to edit documents in libraries/lists that are inheriting permissions from the parent. Why is that?

And if I change the Site Members group's permissions to Read, then even when I grant an external user Edit permissions to a document, they still cannot edit the document and the permissions sometimes don't even get updated on the Manage Access page for the document. If I go to the advanced page for the permissions on the document and check that external user's permissions directly, "Contribute" is listed as "given directly".

What's going on here? Am I setting permissions incorrectly?

EDIT 8/24/2021: Adding screenshots of how permissions are currently configured

Site Permissions - Members have Read permissions only

Site Permissions Advanced (Note: Members are listed with Edit permissions! Shouldn't it be Read, as per the first screenshot?)

Library Permissions (for Site Pages)

Item Level Permissions + Sharing Link (my external user granted edit permissions)

Effective Permissions - Site and Site Pages (again - Members showing as having Edit permissions, which doesn't seem right)

Effective Permissions - Item Level

It seems the last image shows the problem. Shouldn't the Read permissions granted by the user's membership in Visitors be superseded by the item-level Edit permissions?

Answer 1

According to my understanding:

• Add "Everyone except external users" to the Site Members group, and the Site Members group has Edit permissions.
• Add External users to the Site Visitors group, and the Site Visitors group has Read permissions.
• However, these External users can still edit documents in libraries/lists that inherit permissions from the parent.

Please perform the following troubleshooting:

1.Access to the Site Permissions page to check user permissions. Please check whether the External user has only Read permissions.

2.Ensure that the list/library inherits permissions from the parent.

3.Select the document/item and click on Manage access

4.On the Manage Access panel, click on Advanced

5.Ensure that the document/item inherits permissions from the parent. Of course, you can also check at the document-level (item-level) whether the External user has only Read permissions

========================= Updated Answer ===========================

On the Site Permissions Level: External user exists in both the Site Members group and the Site Visitors group.

When a user has different permission levels, the SharePoint defaults that the user's permission level is the highest among these different permission levels. This means that the External user has Edit permissions.

If you want to everyone else (always external users) have Read permissions to everything (unless otherwise specified, per-list/library and per-document), please the following steps:

1.Restore the Site permissions settings, List or Library permissions settings and Item permission settings to the original default settings

2.On the Site Permissions page, clikc on Create Group named "Everyone Else" and grant Read Permissions.

3.On the Everyone else group, click on New to add all external users to this group.

4.Go back the Site Permissions page and refresh page, to check the external user permissions.

5.If you want to the external user has other permissons for specifice list/library/item/file. You can Stop Inheriting Permissions and grant the user permissions directly without adding him/her to the group.