Helpdesk: "A site owner typed Everyone except external users in the People Picker on the Partners site and nothing came back. On the company intranet it used to show up. Can you just re-enable the Everyone group so they can share with the whole company?" Twenty minutes later a second ticket: a guest who accepted an invite last month can open a folder that was shared with Everyone, and Security wants that claim "turned off forever."
Don't flip random claim switches yet. Everyone except external users (often shortened to EEEU) is a special SharePoint claim, not a security group you manage in the Microsoft 365 admin center. It only does what you expect when the whole chain holds: you know which claim you're talking about (Everyone vs Everyone except external users vs All Users) → the tenant still shows EEEU in People Picker (ShowEveryoneExceptExternalUsersClaim) → if the site is private, the private-site picker setting allows it (AllowEveryoneExceptExternalUsersClaimInPrivateSite, default off) → on a Public Microsoft 365 group-connected team site you understand the default Edit grant Microsoft documents → existing ACL entries still work even when the claim is hidden from the picker → you are not trying to "fix" external sharing with this claim. Microsoft's Set-SPOTenant docs and the default SharePoint groups article are the sources for that chain — not a blog tip that says "recreate the group."
If the real problem is sharing with people outside the company (policies-don't-allow error, Anyone missing, old guest link access denied), that is a different stack. See SharePoint External Sharing Not Working. If a guest can't sign in at all, use AADSTS50020 or AADSTS53003. This post covers EEEU missing from People Picker, not granting the access you thought, or being confused with the Everyone claim.
TL;DR
- EEEU is a claim, not an Entra group. Microsoft says every user added to your organization automatically becomes a member. Guests who accepted invitations are not in it. You will not find it as a normal group in the Microsoft 365 admin center.
-
Missing in People Picker ≠ deleted.
Set-SPOTenant -ShowEveryoneExceptExternalUsersClaim $falsehides the claim from the picker. It does not remove permissions already granted with that claim. -
Private sites hide it by default.
AllowEveryoneExceptExternalUsersClaimInPrivateSitedefaults to false, so EEEU is not available in the People Picker of a private site until an admin turns that on. - Public team sites grant Edit by default. On a Microsoft 365 group-connected team site set to Public, Microsoft says EEEU gets Edit and you can't change that default grant. Private group-connected sites do not get that automatic grant; you can add EEEU manually via Site permissions.
- Everyone ≠ EEEU. Sharing with Everyone includes authenticated external users who previously accepted invitations. Sharing with EEEU is organization members only. Security tickets that say "a guest saw it" are often the wrong claim.
- Don't "recreate Everyone except external users." You can't. Read the tenant claim flags and the site privacy setting first.
Where in the chain did it break?
| Step | What should be true | Typical symptom when it breaks |
|---|---|---|
| 1. Symptom captured | Exact wording: missing in picker vs access denied vs guest could open | "Permissions are broken" with no site URL or screenshot |
| 2. Right claim | Ticket is about EEEU, not Everyone / All Users / a real security group | Guest accessed content shared with "Everyone" |
| 3. Tenant picker flag |
ShowEveryoneExceptExternalUsersClaim is $true
|
EEEU missing in People Picker on every site |
| 4. Private-site flag | Private site has AllowEveryoneExceptExternalUsersClaimInPrivateSite $true if owners should pick it |
Works on Public intranet; missing only on private sites |
| 5. Site privacy / group | Public group-connected team site expected Edit for whole org; Private needs a manual add | "New private team can't share with company" |
| 6. Existing ACL | Hidden claim still present on Site permissions / Sharing dialog Advanced | "We hid it but people still have access" (expected) |
| 7. Not external sharing | Org/site sharing settings are a separate problem | Policies-don't-allow / Anyone missing — wrong article |
Write down the site URL, whether the Microsoft 365 group (if any) is Public or Private, whether the owner used the modern Sharing dialog or classic Site permissions, the exact search string they typed, and whether a guest or an internal user is the one who can or can't open the content.
Step 1: Capture the exact symptom (read-only)
| What the user sees | Most likely layer |
|---|---|
| People Picker returns nothing for "Everyone except external users" on every site | Tenant ShowEveryoneExceptExternalUsersClaim is $false
|
| Same search works on the intranet / Public site, fails on a private site |
AllowEveryoneExceptExternalUsersClaimInPrivateSite is $false (default) |
| Public team site: whole company can edit; owner wants that gone | Default EEEU Edit on Public group-connected team sites (documented; not a People Picker bug) |
| Private team: company-wide share never applied | No automatic EEEU grant on Private; claim may also be hidden in the private-site picker |
| Guest opened content that was shared with Everyone | Wrong claim. Everyone includes invited guests |
| Internal user can't open content that "was shared with everyone" | Check which claim or group is actually on the ACL; unique permissions; Information Barriers / Restricted Access Control if your tenant uses them |
| Admin "disabled EEEU" but old shares still work | Expected. Hiding the claim does not strip existing grants |
Microsoft's default groups article is explicit: EEEU is a special group that does not appear in the Microsoft 365 admin center. If someone asks you to "find the group and add members," stop — membership is automatic for organization users.
Step 2: Map the three claims (read-only)
| Claim | Who it includes (per Microsoft Set-SPOTenant docs) |
People Picker control |
|---|---|---|
| Everyone except external users | All organization members in the tenant's Microsoft Entra ID; not users who previously accepted invitations (guests) |
ShowEveryoneExceptExternalUsersClaim (default true = shown) |
| Everyone | All authenticated users in the tenant's Microsoft Entra ID, including active external users who previously accepted invitations |
ShowEveryoneClaim (default false on newer tenants; was true for many tenants older than March 2018) |
| All Users (…) | Legacy authentication-method claim groups; All Users (authenticated) is equivalent to Everyone and shows as Everyone |
ShowAllUsersClaim (default true = shown) |
Extra private-site switch for EEEU only:
| Setting | Default | Effect |
|---|---|---|
AllowEveryoneExceptExternalUsersClaimInPrivateSite |
false | When false, EEEU is not available in the People Picker of a private site |
That table alone resolves most "it used to work on the company site but not on this project site" tickets: the project site is private, and the private-site picker flag is still at the default.
Step 3: Read the tenant claim flags (read-only)
SharePoint Online Management Shell, signed in as a SharePoint Administrator:
# Read-only. Connect-SPOService -Url https://contoso-admin.sharepoint.com
Get-SPOTenant | Select-Object `
ShowEveryoneExceptExternalUsersClaim,
AllowEveryoneExceptExternalUsersClaimInPrivateSite,
ShowEveryoneClaim,
ShowAllUsersClaim,
ProvisionSharedWithEveryoneFolder
How to read the output:
| Property | What $true means |
What $false means |
|---|---|---|
ShowEveryoneExceptExternalUsersClaim |
EEEU appears in People Picker (default) | EEEU is hidden from People Picker tenant-wide |
AllowEveryoneExceptExternalUsersClaimInPrivateSite |
EEEU can be picked on private sites | EEEU hidden on private sites (default) |
ShowEveryoneClaim |
Everyone appears in People Picker | Everyone hidden (default on newer tenants) |
ShowAllUsersClaim |
All Users claim groups appear | Those groups hidden |
ProvisionSharedWithEveryoneFolder |
New OneDrive libraries get a "Shared with Everyone" folder (legacy default behavior changed in August 2015 — confirm against your tenant) | Folder not created for new OneDrive libraries |
There is no SharePoint admin center toggle with the friendly name "Everyone except external users" on the main Sharing page. The People Picker visibility is a tenant PowerShell (or equivalent admin API) setting. If someone "fixed sharing" last quarter with a script, this is often where it landed.
Step 4: Check site privacy and the Public-team default (read-only)
For a Microsoft 365 group-connected team site, Microsoft documents:
| Group / site privacy | Default EEEU behavior |
|---|---|
| Public | EEEU has a default permission level of Edit. You can't change that default grant on group-connected team sites. |
| Private | No automatic EEEU grant. EEEU can be added manually through Site permissions. People Picker still obeys the private-site tenant flag above. |
How to confirm privacy without changing anything:
- Open the site → Settings (gear) → Site information (Microsoft's documented path to change privacy).
- Note Public vs Private.
- Open Settings → Site permissions (and Advanced permissions settings if you need the classic ACL) and look for Everyone except external users already listed.
If the ticket is "the whole company can edit our Public team and we hate it," that is often by design for Public group-connected team sites. The fix is usually change the group to Private (after change control), not hunting for a broken EEEU group. Microsoft says you can't change the default EEEU permissions on those Public group-connected team sites.
Communication sites and other non-group sites do not get that automatic Public-team EEEU Edit grant. On those, EEEU only appears if someone added it, and only if the picker flags allow selecting it.
Step 5: Prove whether the claim is on the ACL (read-only)
Hiding EEEU from People Picker does not remove it from sites where it was already granted. Before you "turn it back on" or "wipe permissions," read what is actually there:
- Site → Settings → Site permissions.
- Check membership of Owners / Members / Visitors and any SharePoint groups.
- Use Advanced permissions settings → check for EEEU on the site, and for libraries/folders with unique permissions (broken inheritance).
- For a single file/folder: Manage access / Advanced and note every principal.
| Finding | Meaning |
|---|---|
| EEEU on site Visitors (Read) | Whole org (non-guest) can read; picker visibility is irrelevant to existing access |
| EEEU on Public team Members-equivalent via default Edit | Expected Public group-connected behavior |
| No EEEU on ACL; owner can't pick it | Picker flag / private-site flag problem, not "corrupt permissions" |
| Everyone on ACL; guest can open | Wrong claim for an internal-only share |
Related OneDrive legacy note: ProvisionSharedWithEveryoneFolder controls whether new OneDrive libraries get a "Shared with Everyone" folder. That is not the same as the EEEU claim in People Picker, but tickets sometimes blur "Shared with Everyone" and "Everyone except external users." Read both if the path is OneDrive.
Step 6: Don't confuse this with external sharing
| Ticket language | Go to |
|---|---|
| "Can't invite a vendor" / policies don't allow / Anyone greyed out | SharePoint External Sharing Not Working — org/site sharing level, domain lists, B2B |
| "EEEU missing in the picker" / "whole company share" | This article — claim flags + site privacy |
| "Guest can see something shared with Everyone" | This article Step 2 (wrong claim), then tighten the ACL |
| Guest sign-in / AADSTS | Guest triage posts linked above |
Turning external sharing off does not create the EEEU claim, and turning EEEU visibility on does not enable external sharing. They are separate controls.
Step 7: Change one flag (only after the read)
Only after Steps 1–6, and only with change control:
# EXAMPLES — deliberate changes. Prefer one change, then retest People Picker.
# Show EEEU again tenant-wide:
# Set-SPOTenant -ShowEveryoneExceptExternalUsersClaim $true
# Allow picking EEEU on private sites (default is false):
# Set-SPOTenant -AllowEveryoneExceptExternalUsersClaimInPrivateSite $true
# Hide Everyone (includes guests) from People Picker — common hardening:
# Set-SPOTenant -ShowEveryoneClaim $false
Retest:
- Private site People Picker search for
Everyone except external users. - Public site People Picker (should already work if the tenant flag is true).
- Confirm you did not grant a new ACL entry just by showing the claim — visibility ≠ permission.
If Information Barriers or Restricted Access Control are enabled in your tenant, broad principals can still fail in ways that look like "EEEU not working." Treat those as a separate compliance stack: confirm with your compliance admin before forcing EEEU onto a restricted site.
When a change is justified
| Finding | Prefer | Avoid |
|---|---|---|
| EEEU missing everywhere | Set ShowEveryoneExceptExternalUsersClaim $true after confirming policy allows org-wide picks |
Recreating a "group" in Entra or M365 admin center |
| Missing only on private sites | Set AllowEveryoneExceptExternalUsersClaimInPrivateSite $true if private-site owners should use it |
Flipping the tenant Everyone claim |
| Public team editable by whole company | Change group privacy to Private (with owner approval), then redesign membership | Trying to edit the default EEEU grant Microsoft says you can't change |
| Guest accessed "company-wide" share | Remove Everyone / replace with EEEU or a real security group | Blaming external sharing settings alone |
| Security wants no org-wide picks | Hide EEEU / Everyone in People Picker; educate owners to use security groups | Deleting site permissions blindly without an ACL inventory |
| Old EEEU grants remain after hide | Inventory and remove site-by-site if policy requires | Assuming Show… $false stripped access |
| Vendor can't be invited | Follow the external sharing triage article | Enabling EEEU to "fix" guest sharing |
FAQ
Why is SharePoint Everyone except external users not working?
Usually one of: the tenant hid it with ShowEveryoneExceptExternalUsersClaim $false; the site is private and AllowEveryoneExceptExternalUsersClaimInPrivateSite is still at the default false; the owner expected the Public team-site default Edit grant on a Private site; or they confused EEEU with the Everyone claim (which includes guests). Read Get-SPOTenant for the claim flags, then Site information for Public vs Private.
Why is Everyone except external users missing or not available in People Picker?
Microsoft documents two switches. Tenant-wide: ShowEveryoneExceptExternalUsersClaim (default shown). Private sites: AllowEveryoneExceptExternalUsersClaimInPrivateSite (default not available). Hiding the claim does not delete existing permissions that already used it.
Who is in Everyone except external users?
Microsoft says all users added to your organization automatically become members. It is a special SharePoint group/claim that does not appear in the Microsoft 365 admin center. Guests who accepted invitations are excluded (that is the point of the name).
What's the difference between Everyone and Everyone except external users?
Per Set-SPOTenant: Everyone includes authenticated users in the tenant directory including active external users who previously accepted invitations. Everyone except external users is organization members only — not those invited guests. If a guest could open the content, check which principal is actually on the ACL.
Can I remove Everyone except external users from a Public Microsoft 365 team site?
Microsoft says you can't change the default permissions granted to EEEU on Microsoft 365 group-connected team sites. On Public group-connected team sites, EEEU gets Edit by default. The practical control is the group's privacy (Public vs Private) and deliberate membership, not editing that default grant. On Private group-connected sites, EEEU is not automatic; it can be added manually via Site permissions when the picker allows it.
Related posts
- SharePoint External Sharing Not Working (org/site sharing, domain lists, Entra B2B — different feature from EEEU)
- AADSTS50020 User Account Does Not Exist in Tenant (guest can't sign in)
- AADSTS53003 Blocked by Conditional Access (guest blocked at sign-in)
- Restore a Deleted SharePoint Site, OneDrive, or File (when "can't access" is really "it's gone")
- An Offboarding Checklist for M365 + Intune Admins (access removal when someone leaves — don't rely on EEEU alone)
Free checklist
Once People Picker and site permissions behave again, the next request is usually a Conditional Access or sharing lockdown that hits the same owners on Monday morning. Before you enforce, the free Conditional Access pre-enforcement checklist keeps break-glass accounts, pilot groups, and report-only review on one page:
If you want the Intune and Microsoft 365 admin runway (assignment, compliance, and day-2 ops checklists) in one pack for the next wave of "make SharePoint and devices match policy" work, the Intune & M365 Admin Starter Pack is here: https://cashflow4375.gumroad.com/l/joonf?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=sharepoint-everyone-except-external-users-not-working
Admin Pack Studio; not affiliated with Microsoft. Steps 1–6 only read: site permissions UI and Get-SPOTenant. Changing ShowEveryoneExceptExternalUsersClaim, AllowEveryoneExceptExternalUsersClaimInPrivateSite, ShowEveryoneClaim, site/group privacy, and ACL membership are deliberate changes. Make one change, retest People Picker and access with an internal user and a guest test account, and check current Microsoft Learn for parameter defaults on your module version.
Top comments (0)