I have a Modern Site connected to a M365 Group. Aside from the site owners, I want everyone else to only have Read permissions to everything (unless otherwise specified, per-list/library and per-document). "Everyone else" will almost always be external users to the tenant, granted access through invitation.
When the default Site Members group has Edit permissions, these external users - who are part of the Site Visitors group - still has the ability to edit documents in libraries/lists that are inheriting permissions from the parent. Why is that?
And if I change the Site Members group's permissions to Read, then even when I grant an external user Edit permissions to a document, they still cannot edit the document and the permissions sometimes don't even get updated on the Manage Access page for the document. If I go to the advanced page for the permissions on the document and check that external user's permissions directly, "Contribute" is listed as "given directly".
What's going on here? Am I setting permissions incorrectly?
EDIT 8/24/2021: Adding screenshots of how permissions are currently configured
Site Permissions - Members have Read permissions only
Site Permissions Advanced (Note: Members are listed with Edit permissions! Shouldn't it be Read, as per the first screenshot?)
Library Permissions (for Site Pages)
Item Level Permissions + Sharing Link (my external user granted edit permissions)
Effective Permissions - Site and Site Pages (again - Members showing as having Edit permissions, which doesn't seem right)
Effective Permissions - Item Level
It seems the last image shows the problem. Shouldn't the Read permissions granted by the user's membership in Visitors be superseded by the item-level Edit permissions?