10/31/2026
Every Microsoft 365 tenant has an “Everyone except external users” group. It’s handy, because one click shares a site with the whole company.
It’s also an easy way to overshare. 😬 One careless addition and content meant for a few people is visible to everyone internal. Public Teams and Microsoft 365 Groups add it automatically too, so some sites are exposed before anyone shares anything.
In this blog article, I show how to find them with the “Sites and files shared via special SharePoint groups” report in SharePoint Advanced Management:
🔎 Where to run it: SharePoint admin center > Reports > Data access governance. Pick the “Everyone except external users” report and click Run Report.
⏳ Expect to wait: it runs in the background and can take 24 hours or more. Go get a coffee, or sleep on it.
🔑 Global Admin isn’t enough: you need the SharePoint Advanced Administrator role and a SAM license. You can also only run it about once every 30 days.
🧹 Fixing what you find: remove the group from site permissions, switch public teams to private, and use Site-Level Access Restriction on sensitive sites like HR, Finance, and Legal.
Read more: https://sharepointmaven.com/expose-oversharing-with-everyone-except-external-users-group/