How to audit "Everyone except external users" in SharePoint before Microsoft 365 Copilot
Microsoft 365 Copilot does not change who can see what. It works within each user's existing permissions. That is reassuring until you remember how many files are quietly shared with Everyone except external users. Before Copilot, nobody stumbled onto a forgotten salary spreadsheet in a five-year-old team site. With Copilot, a simple question can bring it up.
What "Everyone except external users" actually means
EEEU is a built-in claim that covers every internal account in your tenant. When it is granted on a site, library, folder or file, every employee can open that content, whether they know it exists or not. It is commonly added when a site is made "public" to the organization, or when someone picks it in the share dialog to save time.
Where broad access hides
- Site level: EEEU added to the site's Visitors or Members group.
- Library or list level: inheritance broken on one library and EEEU added there.
- Folder and file level: one-off grants on a single folder or document, the hardest to spot by browsing.
- Large groups: an "All Company" Microsoft 365 group can have the same effect as EEEU.
Checking the site's permission page only shows the first item. You need a report that walks every location with unique permissions.
Step-by-step audit
1. List your high-risk sites
Start with HR, finance, legal and leadership sites, plus any site with a large internal audience.
2. Report every permission location
Smart Permissions is a free, open-source SharePoint web part that lists every site, library, folder and file with unique permissions, expands Microsoft 365 group members, flags external guests and exports the whole report to Excel. No PowerShell required.
3. Filter for broad groups
In Excel, filter the principal column for Everyone except external users, Everyone, and any very large group. Sort by location so you can review one site at a time.
4. Decide with the content owner
Some company-wide access is intentional, like policies or the intranet home site. Confirm each grant with the site owner instead of removing everything at once.
5. Remove or narrow unintended grants
Make changes in SharePoint's own permission settings (Smart Permissions is read-only), then re-run the report to confirm the broad grants are gone.
Related resources
- Copilot oversharing self-assessment
- SharePoint permissions: complete reference
- SharePoint permissions report in Excel
Need help planning a Copilot readiness review? Contact us.
Was this page helpful?
One click. No form, no email address.
Missing something in SharePoint Smart Permissions? Feature requests and bug reports go straight to the developer on GitHub — no account needed to read, free account to post.
Request a featureRelated tool
SharePoint Smart Permissions
Visual permissions audit + Excel export. No PowerShell. Free, MIT licensed, no sign-up.
Keep reading
How to find external users in SharePoint (free report)
Guest access accumulates quietly: a shared link here, a project team there. Here's how to produce a defensible list of every external user on a site — and what they can actually reach — without PowerShell.
How to build a SharePoint permissions matrix for a site collection
A permissions matrix answers one question for auditors: for every securable object in this site collection, who has access and how did they get it? Here's how to produce one for free.
Who Has Access to This SharePoint Folder? 3 Free Ways to Check
The SharePoint 'Manage Access' panel shows groups, not people. Here's how to expand every group and sharing link into an actual list of humans.
About the author
Sean Regan
SharePoint & Microsoft 365 consultant with 20+ years of hands-on experience building SPFx web parts, migration tooling and tenant-grade automation. Maintainer of the open-source SharePoint Smart Solutions suite.