Avoid external/guest users from being added to Owner or FullControl groups

%3CLINGO-SUB%20id%3D%22lingo-sub-1523248%22%20slang%3D%22en-US%22%3EAvoid%20external%2Fguest%20users%20from%20being%20added%20to%20Owner%20or%20FullControl%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1523248%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3Ethe%20use%20case%20is%20to%20have%20Site%20Collections%20being%20shared%20with%20externals%2Fguest%20users%20but%20we%20are%20looking%20for%20a%20technical%20solution%20to%20prohibit%20externals%20to%20be%20assigned%20to%20SharePoint%20permission%20groups%20having%20full%20control%20for%20example.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20an%20OOTB%20way%20to%20avoid%20this%20or%20a%20smart%20workaround%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAll%20of%20what%20we%20considered%20so%20far%20would%20be%20rather%20reporting%20on%20it%20through%20logs%2C%20site%20discoveries...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1523248%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EPermissions%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1523567%22%20slang%3D%22en-US%22%3ERe%3A%20Avoid%20external%2Fguest%20users%20from%20being%20added%20to%20Owner%20or%20FullControl%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1523567%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F729154%22%20target%3D%22_blank%22%3E%40MichaelJ88%3C%2FA%3E%26nbsp%3B%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20only%20ever%20been%20able%20to%20stop%20members%20of%20the%20Owners%20group%20adding%20other%20users%20to%20the%20owners%20group%20as%20below%2C%20change%20the%20Owner%20of%20the%20group%20to%20a%20site%20collection%20admin.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Team%20owners.PNG%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F205472i5C2EBB211AFC7024%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Team%20owners.PNG%22%20alt%3D%22Team%20owners.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20cannot%20as%20far%20as%20I%20know(last%20time%20a%20looked)%20stop%20owners%20with%20Full%20control%20creating%20a%20new%20SharePoint%20group%20with%20Full%20Control.%20For%20that%20it%20would%20be%20down%20to%20a%20training%20issue.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Regular Visitor

Hi,

the use case is to have Site Collections being shared with externals/guest users but we are looking for a technical solution to prohibit externals to be assigned to SharePoint permission groups having full control for example.

 

Is there an OOTB way to avoid this or a smart workaround?

 

All of what we considered so far would be rather reporting on it through logs, site discoveries...

 

 

1 Reply

Hi @MichaelJ88 ,

 

I have only ever been able to stop members of the Owners group adding other users to the owners group as below, change the Owner of the group to a site collection admin. 

 

Team owners.PNG

 

You cannot as far as I know(last time a looked) stop owners with Full control creating a new SharePoint group with Full Control. For that it would be down to a training issue.