Pnp provisoning issue with permissions for Everyone except external users

%3CLINGO-SUB%20id%3D%22lingo-sub-388518%22%20slang%3D%22en-US%22%3EPnp%20provisoning%20issue%20with%20permissions%20for%20Everyone%20except%20external%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-388518%22%20slang%3D%22en-US%22%3E%3CP%3EBasically%2C%20I've%20setup%20a%20Pnp%20powershell%20script%20that%20is%20triggered%20by%20a%20site%20design%26nbsp%3B(site%20design%2Fscript%20-%26gt%3B%20flow%20-%26gt%3B%20azure%20queue%20-%26gt%3B%20azure%20function%20...)%20to%20provision%20a%20newly%20created%20public%20Team%20site%20in%20my%20organization.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20Pnp%20script%20adjust%2C%20among%20others%2C%20the%20permission%20settings%20for%20%22Everyone%20except%20external%20user%22%20from%20the%20standard%20one%20(being%20in%20the%20Members%20group%20with%20edit%20permission)%20to%20the%20Visitor%20group%20with%20read%20permission.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere%20is%20the%20part%20of%20the%20provisioning%20script%20that%20set%20the%20permission%20%3A%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EAdd-PnPUserToGroup%20-LoginName%20%3C%2FSPAN%3E%3CSPAN%3E%24everyone_except_external_user_login%3C%2FSPAN%3E%3CSPAN%3E%20-Identity%20%3C%2FSPAN%3E%3CSPAN%3E4%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3ERemove-PnPUserFromGroup%20-LoginName%20%3C%2FSPAN%3E%3CSPAN%3E%24everyone_except_external_user_login%3C%2FSPAN%3E%3CSPAN%3E%20-Identity%20%3C%2FSPAN%3E%3CSPAN%3E5%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhile%20the%20permission%20is%20effectively%20applied%20and%20visible%20in%20the%20newly%20provisioned%20site%2C%20it%20is%20somehow%20reset%20after%20a%20few%20minutes%20to%20the%20original%20setting.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20am%20I%20missing%20here%20%3F%20Any%20hints%20%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-388518%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EPermissions%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPowerShell%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-482382%22%20slang%3D%22en-US%22%3ERe%3A%20Pnp%20provisoning%20issue%20with%20permissions%20for%20Everyone%20except%20external%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-482382%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F308008%22%20target%3D%22_blank%22%3E%40Auren10%3C%2FA%3E%26nbsp%3Bthis%20is%20what%20I've%20been%20told%20by%20the%20escalation%20team%20regarding%20permissions%20reverting%20back%20from%20read%20to%20edit%20for%20%22Everyone%20Except%20External%20Users%22%20on%20public%20group%20site%20(which%20does%20not%20makes%20any%20sense%20to%20me)%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CEM%3EHello%20Martin%2C%3C%2FEM%3E%3C%2FP%3E%3CP%3E%3CEM%3EI%20just%20had%20a%20discussion%20with%20Escalation%20Team%20and%20got%20to%20know%20that%20this%20is%20a%20known%20behavior%20globally.%20This%20has%20been%20confirmed%20that%20this%20is%20how%20a%20Public%20Group%20Site%20collection%20should%20work.%20In%20order%20to%20get%20this%20resolved%20we%20can%20follow%20either%20of%20the%20following%20step.%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3COL%3E%3CLI%3E%3CEM%3ERemove%20the%20Members%20Group%20from%20Public%20Group%20Site%20collection%3C%2FEM%3E%3C%2FLI%3E%3C%2FOL%3E%3CP%3E%3CEM%3EOR%3C%2FEM%3E%3C%2FP%3E%3COL%3E%3CLI%3E%3CEM%3ERename%20the%20Members%20Group%20and%20then%20change%20the%20permission.%3C%2FEM%3E%3C%2FLI%3E%3C%2FOL%3E%3CP%3E%3CEM%3EOR%3C%2FEM%3E%3C%2FP%3E%3COL%3E%3CLI%3E%3CEM%3EIf%20we%20explicitly%20wants%20all%20users%20not%20to%20have%20EDIT%20permission%20then%20we%20can%20create%20new%20SPO%20Site%20Collection%20and%20make%20required%20changes.%3C%2FEM%3E%3C%2FLI%3E%3C%2FOL%3E%3CP%3E%3CEM%3EYour%20patience%20is%20highly%20appreciated%3C%2FEM%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-482356%22%20slang%3D%22en-US%22%3ERe%3A%20Pnp%20provisoning%20issue%20with%20permissions%20for%20Everyone%20except%20external%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-482356%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F308008%22%20target%3D%22_blank%22%3E%40Auren10%3C%2FA%3E%26nbsp%3B%2C%20I%20have%20the%20exact%20same%20issue%20without%20using%20PnP%20(Just%20using%20the%20UI).%20After%20setting%20permissions%20for%20EEEU%20from%20edit%20to%20read%2C%20it%20will%20change%20back%20to%20edit%20after%20a%20while.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20check%20the%20audit%20log%20and%20sometimes%20the%20change%20is%20done%20by%20the%20Microsoft%5CServiceAccount%20or%20the%20site%20owner%20(knowing%20the%20site%20owner%20did%20not%20change%20the%20permission%20on%20the%20site).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20does%20not%20occurs%20in%20team%20site%20not%20connected%20to%20O365%20group.%20I'm%20sure%20there%20is%20a%20job%20issue%20related%20to%20Azure%20O365%20groups%20doing%20some%20changes%20in%20SharePoint.%20I'm%20struggling%20with%20Microsoft%20to%20find%20what%20is%20the%20issue...%20For%20now%20looks%20to%20be%20tenants%20related%20(because%20Microsoft%20say%20they%20can't%20replicate%20the%20issue)%20but%20I%20have%20customers%20in%20Canada%20and%20US%20where%20the%20issue%20occurs...%20I%20look%20forward%20to%20see%20if%20you%20will%20get%20more%20details%20on%20this.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-499686%22%20slang%3D%22en-US%22%3ERe%3A%20Pnp%20provisoning%20issue%20with%20permissions%20for%20Everyone%20except%20external%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-499686%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F24099%22%20target%3D%22_blank%22%3E%40Martin%20Coupal%3C%2FA%3Ethanks%20for%20the%20reply%20!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20finally%20get%20to%20a%20similar%20solution%20but%20on%20a%20private%20team%20site%3A%3C%2FP%3E%3COL%3E%3CLI%3ECreate%20a%20new%20group%20with%20the%20desired%20permissions%20(Read%22%20permission%20in%20my%20case)%3C%2FLI%3E%3CLI%3EAdd%20%22Everyone%20Except%20External%20Users%22%20on%20this%20group%3C%2FLI%3E%3C%2FOL%3E%3CP%3EFor%20info%3A%3C%2FP%3E%3CP%3EAdding%20%22Everyone%20Except%20External%20Users%22%20in%20the%20%22Visitors%22%20group%20on%20a%20private%20site%20has%20a%20similar%20behavior%20as%20on%20public%20site.%20After%20some%20time%20%22Everyone%20Except%20External%20Users%22%20is%20removed%20from%20the%20%22Visitors%22%20group%20...%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-499689%22%20slang%3D%22en-US%22%3ERe%3A%20Pnp%20provisoning%20issue%20with%20permissions%20for%20Everyone%20except%20external%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-499689%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F24099%22%20target%3D%22_blank%22%3E%40Martin%20Coupal%3C%2FA%3E%26nbsp%3B%26nbsp%3B%20thanks%20for%20the%20reply%20!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20finally%20get%20to%20a%20similar%20solution%20but%20on%20a%20private%20team%20site%3A%3C%2FP%3E%3COL%3E%3CLI%3ECreate%20a%20new%20group%20with%20the%20desired%20permissions%20(Read%22%20permission%20in%20my%20case)%3C%2FLI%3E%3CLI%3EAdd%20%22Everyone%20Except%20External%20Users%22%20on%20this%20group%3C%2FLI%3E%3C%2FOL%3E%3CP%3EFor%20info%3A%3C%2FP%3E%3CP%3EAdding%20%22Everyone%20Except%20External%20Users%22%20in%20the%20%22Visitors%22%20group%20on%20a%20private%20site%20has%20a%20similar%20behavior%20as%20on%20public%20site.%20After%20some%20time%20%22Everyone%20Except%20External%20Users%22%20is%20removed%20from%20the%20%22Visitors%22%20group%20...%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-499795%22%20slang%3D%22en-US%22%3ERe%3A%20Pnp%20provisoning%20issue%20with%20permissions%20for%20Everyone%20except%20external%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-499795%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F308008%22%20target%3D%22_blank%22%3E%40Auren10%3C%2FA%3E%26nbsp%3B%2C%20For%20%3CSTRONG%3Eprivate%3C%2FSTRONG%3E%20group%20site%2C%20this%20is%20a%20%22By%20Design%22%20behavior.%20Personnaly%20I%20think%20this%20is%20causing%20confusion%20as%20site%20owner%20are%20allowed%20to%20add%20EEEU%20and%20set%20the%20permission%20but%20a%20background%20process%20%22play%22%20with%20permission.%20IMO%2C%20this%20is%20not%20good.%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4492201%2Feveryone-except-external-users-group-is-removed%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4492201%2Feveryone-except-external-users-group-is-removed%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20for%20%3CSTRONG%3Epublic%3C%2FSTRONG%3E%20group%20site%20I%20never%20saw%20this%20was%20a%20%22By%20design%22%20behavior%20(And%20It%20would%20not%20make%20sense%20if%20it%20was).%20I'm%20still%20in%20discussion%20with%20Microsoft%20on%20this.%20I'm%20waiting%20for%20an%20answer.%20Apparently%20it's%20not%20happening%20on%20all%20tenants%20but%20surely%20other%20people%20are%20having%20the%20issue%20(on%20my%20side%20I%20have%20the%20problems%20with%20my%20customers%20tenants%20in%20Canada%20and%20my%20tenant%20in%20the%20US).%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Basically, I've setup a Pnp powershell script that is triggered by a site design (site design/script -> flow -> azure queue -> azure function ...) to provision a newly created public Team site in my organization.

 

This Pnp script adjust, among others, the permission settings for "Everyone except external user" from the standard one (being in the Members group with edit permission) to the Visitor group with read permission.

 

Here is the part of the provisioning script that set the permission :

Add-PnPUserToGroup -LoginName $everyone_except_external_user_login -Identity 4
Remove-PnPUserFromGroup -LoginName $everyone_except_external_user_login -Identity 5

 

While the permission is effectively applied and visible in the newly provisioned site, it is somehow reset after a few minutes to the original setting.

 

What am I missing here ? Any hints ?

 

 

 

5 Replies

@Auren10 , I have the exact same issue without using PnP (Just using the UI). After setting permissions for EEEU from edit to read, it will change back to edit after a while.

 

I've check the audit log and sometimes the change is done by the Microsoft\ServiceAccount or the site owner (knowing the site owner did not change the permission on the site).

 

This does not occurs in team site not connected to O365 group. I'm sure there is a job issue related to Azure O365 groups doing some changes in SharePoint. I'm struggling with Microsoft to find what is the issue... For now looks to be tenants related (because Microsoft say they can't replicate the issue) but I have customers in Canada and US where the issue occurs... I look forward to see if you will get more details on this.

Highlighted

@Auren10 this is what I've been told by the escalation team regarding permissions reverting back from read to edit for "Everyone Except External Users" on public group site (which does not makes any sense to me):

 

Hello Martin,

I just had a discussion with Escalation Team and got to know that this is a known behavior globally. This has been confirmed that this is how a Public Group Site collection should work. In order to get this resolved we can follow either of the following step.

 

  1. Remove the Members Group from Public Group Site collection

OR

  1. Rename the Members Group and then change the permission.

OR

  1. If we explicitly wants all users not to have EDIT permission then we can create new SPO Site Collection and make required changes.

Your patience is highly appreciated

Highlighted

@Martin Coupalthanks for the reply !

 

I finally get to a similar solution but on a private team site:

  1. Create a new group with the desired permissions (Read" permission in my case)
  2. Add "Everyone Except External Users" on this group

For info:

Adding "Everyone Except External Users" in the "Visitors" group on a private site has a similar behavior as on public site. After some time "Everyone Except External Users" is removed from the "Visitors" group ...

Highlighted

@Martin Coupal   thanks for the reply !

 

I finally get to a similar solution but on a private team site:

  1. Create a new group with the desired permissions (Read" permission in my case)
  2. Add "Everyone Except External Users" on this group

For info:

Adding "Everyone Except External Users" in the "Visitors" group on a private site has a similar behavior as on public site. After some time "Everyone Except External Users" is removed from the "Visitors" group ...

Highlighted

@Auren10 , For private group site, this is a "By Design" behavior. Personnaly I think this is causing confusion as site owner are allowed to add EEEU and set the permission but a background process "play" with permission. IMO, this is not good.

https://support.microsoft.com/en-us/help/4492201/everyone-except-external-users-group-is-removed

 

But for public group site I never saw this was a "By design" behavior (And It would not make sense if it was). I'm still in discussion with Microsoft on this. I'm waiting for an answer. Apparently it's not happening on all tenants but surely other people are having the issue (on my side I have the problems with my customers tenants in Canada and my tenant in the US).