"Everyone except external users" has read permission on many personal OD sites

[roniy]

Hi,

We noticed that the group "Everyone except external users" has read permission on many personal OD sites. The permission appears to be on the site level (not a specific file or folder).

However, when I try to browse to those sites (https://org-my.sharepoint.com/personal/name_org_com ) I don't have access to them. 

I reached out to some of these people and they did not grant this permission intentionally. 

Can anyone explain this behavior?

[#2]

@roniy 

Where are you seeing this group?  Has it been added to the visitors group?

As a wider answer, do you know what your default Sharing settings are?  I suspect that these may be the culprit.  I've seen this a few times where the default sharing settings are configured to the entire organisation.  Quite often the defaults are accepted and that'll result in the "Everyone but external" group being added to an item / site.

[#3]

Thanks @Steven Andrews!

It's not in the visitors group.

So you're saying it must be a result of sharing?

I still wonder why I (an internal user) don't have access while the group is there:

[#4]

That's probably a remnant from back in the day where we had the "shared with everyone" folder. You can still provision that via the ProvisionSharedWithEveryoneFolder switch, but it's no longer enabled by default afaik.

[#5]

@Vasil Michev That's a very good tip.  I'd forgotten about this.  

@roniy  More information on this one here, this was a change back in 2015 I think.  I wasn't able to find the Technet article but this should help out.

https://www.markwilson.co.uk/blog/2015/10/restore-the-shared-with-everyone-folder-in-onedrive-for-bu...

[#6]

Thank you @Vasil Michev!

So this permission is still there but doesn't grant actual access? 

I there an easy way to clean it from all personal sites?