This is in relation to MC129777. Sorry for the long post, I can get a little long-winded sometimes :( From the documentation provided, I'm confused as to what exactly this "new way to govern access" is doing, so if anyone has a technical handle on it I'd love to hear it!
Some reasons for my confusion - the documentation states:
After March 23, 2018, external users will no longer be granted the Everyone, All Authenticated Users or All Forms Users claims by default. Therefore, external users will be granted access only to content shared with the group to which the external user belongs, and content shared directly with the external user. They will not have access to content shared with these three special groups.
New choice to govern the access given to external users
If your organization wants external users to access content shared with Everyone, you may configure your tenant to grant the Everyone claim to external users.
To configure your tenant to grant the Everyone claim to external users, use the following Windows PowerShell cmdlet:
Set-SPOTenant -ShowEveryoneClaim $true
After you run the cmdlet, external users will be granted the Everyone claim and will have access to content shared with the Everyone group.
If your organization wants users to have access to content shared with All Authenticated Users or All Forms Users, you may configure your tenant to grant these two claims to external users.
To configure your tenant to grant the All Authenticated Users and All Forms Users claims to external users, use the following Windows PowerShell cmdlet:
Set-SPOTenant -ShowAllUsersClaim $true
After you run the cmdlet, external users will be granted the All Authenticated Users and All Forms Users claims and will have access to content shared with these two groups.
When looking at the support documentation for the PowerShell cmdlet -ShowAllUsersClaim it says the cmdlet:
Enables the administrator to hide the All Users claim groups in People Picker.
Part of my confusion is it seems this PowerShell cmdlet only hides/shows the Everyone or All Users security claim as an available option when sharing resources. The way the documentation for this change is worded, it sounds like existing external users who were accessing a resource using the "everyone" claim as opposed to being directly shared to the item will no longer be able to access that resource (for example, a team site landing page). It doesn't seem like showing or hiding the Everyone security claim as a sharing option should make any difference to this. Is it changing what this PowerShell cmdlet does? And if so, does this change the value from true to false in tenants where it is set to true, requiring us to go back and set it to true after March 23rd?
Another part of my confusion comes from me quickly reading the message when it first came out and believing the change had to do with the new changes to guest/external user sharing. It makes sense that external users who are not being added as a guest user to our tenant and using the new "verification code" authentication would see not items shared with "everyone". But after a closer reading of this message and the documentation, it is clear this is not what is meant.
If I can get any clarification on what is actually going on behind the scenes, that would help!
-
