Can we deny a user from accessing all sharepoint online sites, while keeping his account active

[john john]

I got a requirement from one of our customers is that they want to prevent an internal  user from accessing all the SharePoint online site collections inside their office 365 tenant, while keep the user account active? so i am not sure if SharePoint online support such an operation.. of course we have many sites which were granted permission through the "Everyone except external" , so this user is granted access to some site indirectly through this group..

[#2]

@john john  you might remove the "Everyone except external" and create a security group to manage permission (I.e Sec_Sharepoint_Allowed_users).

Add all the users except the specific user you want to restrict access. This way you can keep a track of all the users who have access to sharepoint. Further, if you got additional request, you can just remove the user from the security Group :)

[#3]

@Prasannarajuthis will work on paper but since we have lot of sites and sub-sites and each of them have the "Everyone Except external users" ,, so i was looking for a simpler approach to prevent a user from accessing the sites even if the user has permission.  So there is no such an approach either using office 365 or share point online UI or powers-hell? or can we remove the user SharePoint online license (i do not have much knowledge on licensing but i am thinking loudly  )

[#4]

@john john Removing their license will be easiest if you want to block them from all SPO sites,

Please note this will also block their ODfB. I would recommend to test this scenario with test user first and then apply to actual user.

Other option if you dont want to play with License,

Create a powershell script to check the permission level from each site collection from SPO and remove the permissions

https://support.microsoft.com/en-us/kb/3026385