Permission & Access Issues

How to Exclude a User from Everyone Except External Users in SharePoint

Maira Mehtab Sep 21, 2026 868 views

Question details

The user needs to restrict a specific account to access only a single SharePoint site without granting them access to all organizational sites.

Product: Microsoft SharePoint
Device & OS: not provided
Scenario: Managing site access for a specific internal account or contractor in an organization that utilizes broad default permissions across its environment.
Observed behavior: Because the organization extensively uses the 'Everyone Except External Users' claim, the specific account inherently receives unintended access to multiple SharePoint sites.

Before you start

Ensure you have SharePoint Administrator privileges or Site Owner permissions before attempting to modify site access and security groups.

Solution 1Recommended

Create a Dynamic Security Group to Replace Default Permissions

Create a custom dynamic group in Microsoft 365 that includes all employees but explicitly excludes the restricted account, then use this group instead of the default claim.

The 'Everyone Except External Users' claim is a built-in system group that automatically includes all internal users. Since you cannot edit its members directly, the best approach is to replace it with a manageable dynamic security group.

Create the dynamic group

Navigate to the Azure AD portal or Microsoft Entra admin center and create a new Microsoft 365 security group with the membership type set to 'Dynamic User'.

Set exclusion rules

Define a dynamic membership rule that includes all organizational users but specifically adds a condition to exclude the target user's account based on their email or user principal name.

Replace the default group globally

Go to your SharePoint sites (this can be automated via PowerShell) and replace the 'Everyone Except External Users' claim with your newly created dynamic security group.

Solution 2

Assign Site-Specific Groups and Break Permission Inheritance

Remove the global group from individual sites and manage access locally using unique, site-specific permissions.

Free Microsoft Office alternative

Looking for a Lightweight and Compatible Office Suite?

While managing complex SharePoint permissions requires Microsoft administration tools, your daily document work doesn't have to be complicated. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for creating, editing, and sharing documents securely.

1. Download the software: Visit the official WPS Office website and click the free download button.
2. Install WPS Office: Run the installer and follow the quick setup instructions on your screen.
3. Open existing files: Launch WPS Office and directly open your Microsoft Office documents with perfect formatting preservation.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Securely manage and collaborate on documents with intuitive sharing controls.Free and lightweight alternative requiring minimal system resources.Familiar user interface for a seamless transition with zero learning curve.

Frequently Asked Questions

Why does 'Everyone Except External Users' automatically include my restricted account?

This default claim automatically encompasses all internal users synchronized or created in your Microsoft 365 tenant. If the restricted account is an internal user (not a guest), they are automatically included by design.

Can I manually edit the members of 'Everyone Except External Users'?

No, it is a built-in system claim managed automatically by Microsoft 365. You cannot manually add or remove specific users from this default group.

Is it possible to use PowerShell to automate replacing this group across multiple sites?

Yes, you can write a PowerShell script (e.g., using PnP PowerShell) to iterate through your SharePoint sites, remove the 'Everyone Except External Users' claim, and add your custom dynamic security group. Microsoft's Q&A community offers extensive script guidance for this.

Document & File Issues