Sample Powershell to identify groups with HBI classification and have external users
Here's some sample PowerShell that will - Identify Office 365 Groups with a "HBI" classification and if there are Guest users within the group. - Identify the owners of the respective groups - Identify the specific guest users within each group This could be used in conjunction with Microsoft Flow to programmatically - automate the removal of guest users from groups with specific classifications - automate an email to the owners of the group to alert the presence of external (guest) users in an Office 365 Group - automate an email to the owners of the group to indicate the Office 365 Group is not compliant with guest access policy and then programmatically disable/remove external guests $Groups = Get-UnifiedGroup -Filter {GroupExternalMemberCount -gt 0} | Where-Object {$_.Classification -eq 'HBI'} $groups| Format-Table -AutoSize DisplayName, Classification, GroupMemberCount, GroupExternalMemberCount, Managedby ForEach ($G in $Groups) { $Ext = Get-UnifiedGroupLinks -Identity $G.Identity -LinkType Members ForEach ($E in $Ext) { If ($E.Name -match "#EXT#") { Write-Host "Group " $G.DisplayName "includes guest user" $E.Name } } }
New Feature Requests: External Sharing Controls for Office 365 Groups
I would like to request the following external sharing controls for Office 365 groups: Per Group Sharing Controls in order to limit the ability to invite external users to those in a specified security group. (Described here: OneDrive Blog) Ability to disable external sharing by default for newly created Office 365 Groups. Currently if external sharing is enabled at the tenant level, new Office 365 Groups also have external sharing enabled by default. If an organization only wants to allow external sharing for a limited number of Office 365 Groups, but still allow any user to create a new Office 365 Group, IT is required to manually disable external sharing on every new group that is created which is not feasible. Thanks, Adam