What is "Everyone except external users" in SharePoint?

A built-in claim (spo-grid-all-users) that matches every internal account in the tenant. Granting it Read on a site makes the site visible to the whole organisation, including new hires and service accounts, without anyone being added.

How do I find sites shared with Everyone except external users?

The Data Access Governance report lists them tenant-wide (Advanced Management licence). Without it, check each site's role assignments for the spo-grid-all-users claim with PowerShell, or a permissions tool that flags broad grants.

Is "Everyone except external users" the same as "People in your organisation" links?

Functionally similar. An organisation-wide sharing link grants access to anyone in the tenant who has the URL; the claim grants it whether they have the URL or not. Both are broad grants worth reviewing.

Should I remove Everyone except external users from SharePoint sites?

From sites that hold anything confidential, yes — replace it with the specific groups that need access. On intranet and communication sites it is usually intentional.

'Everyone except external users' is on more of your sites than you think

One claim grants every employee, contractor and service account in the tenant access to a site or file. It gets added by templates, by "People in your organisation" links and by well-meaning owners. Here is how to find every instance.

It looks like a group. It is not a group — it is a claim that means every internal account in the tenant, forever, with no membership to review. Add it to a site's Visitors group and the site is company-wide. Add it to a folder and that folder is company-wide inside a site that is otherwise locked down. Copilot and search respect it faithfully, which is how a payroll spreadsheet ends up in a chatbot answer.

How it gets there

Communication site templates add it to Visitors by design. Fine for an intranet; less fine when the template is reused for a project site.
"People in your organisation with the link" sharing links create the equivalent effect for a file or folder. The default link type in many tenants.
Owners trying to "just make it work" for a colleague who cannot get in.
Migrations that map an on-premises NT AUTHORITY\Authenticated Users to it.

Finding it on one site

The claim's login name is c:0-.f|rolemanager|spo-grid-all-users/<tenant-guid>. Its display name is Everyone except external users. Site permissions → Advanced shows it if it is on the site itself; item-level instances need a walk:

Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/Finance -Interactive

$claim = 'spo-grid-all-users'
$hits = New-Object System.Collections.Generic.List[string]

$web = Get-PnPWeb -Includes RoleAssignments
foreach ($ra in $web.RoleAssignments) { $m = Get-PnPProperty -ClientObject $ra -Property Member; if ($m.LoginName -like "*$claim*") { $hits.Add('SITE') } }
foreach ($g in Get-PnPGroup) { if ((Get-PnPGroupMember -Group $g.Title | Where-Object LoginName -like "*$claim*")) { $hits.Add("GROUP: $($g.Title)") } }

foreach ($list in Get-PnPList | Where-Object { -not $_.Hidden }) {
  foreach ($i in Get-PnPListItem -List $list -PageSize 2000 -Fields FileRef) {
    if (Get-PnPProperty -ClientObject $i -Property HasUniqueRoleAssignments) {
      foreach ($ra in Get-PnPProperty -ClientObject $i -Property RoleAssignments) {
        $m = Get-PnPProperty -ClientObject $ra -Property Member
        if ($m.LoginName -like "*$claim*") { $hits.Add("ITEM: $($i['FileRef'])") }
      }
    }
  }
}
$hits

Slow on big libraries (one call per item), but complete. People in your organisation sharing links show up in the same walk as SharingLinks..OrganizationView. / OrganizationEdit groups.

Finding it across the tenant

With SharePoint Advanced Management: Reports → Data access governance → Shared with Everyone except external users. One page, every site, sortable.

Without it: loop Get-SPOSite -Limit All and run the site-level check (the first part of the script, not the item walk) against each. It takes a while and it only catches site- and group-level grants, which is where most of them are.

Deciding what to do

Intranet / communication sites: intended. Leave it, document it.
Team and project sites: replace with the actual M365 group or a security group. Members do not notice; everyone else loses access they never knew they had.
Folders and files: almost always accidental. Remove the grant or the org-wide link; re-share with named people.
Tenant setting: SharePoint admin centre → Sharing → default link type Specific people. It does not remove existing links but stops new ones being org-wide by default.

The flag, not the walk

The reason this needs a tool rather than a quarterly script is that it is a review problem: you want every broad grant on a site flagged, in a list you can hand to the owner, every time you look. WhoHasAccess365's free site report marks Everyone except external users and Everyone as broad grants wherever they appear in the site's groups, and the Pro sweep finds them at item level and in org-wide sharing links.