SharePoint Online: Using PowerShell, enable or disable the “Everyone” group

In this post: What the “Everyone” claims actually are · Why “Everyone” is riskier than it sounds · Showing or hiding the claims with PnP PowerShell · The same settings via SPO Management Shell · This is a visibility setting, not a security control · Auditing where it’s already been granted · Related reading

What the “Everyone” claims actually are

SharePoint Online has two special sharing targets that show up in the People Picker alongside real users and groups: Everyone and Everyone except external users. Sharing something with either one isn’t the same as sharing with a specific person or a SharePoint group — it’s granting access to a whole class of accounts at once. Everyone except external users covers every account in your tenant’s Entra ID, and every new user added to Microsoft 365 is automatically part of it going forward. Everyone is broader still — it also includes guest accounts who’ve already accepted an invitation into the tenant.

Why “Everyone” is riskier than it sounds

The distinction drawn above between the two claims is easy to skim past, but it’s the actual reason “Everyone except external users” is the safer default. “Everyone” includes external guest accounts — not just guests already on this particular site, but anyone who’s ever accepted a guest invitation anywhere in the tenant, for an entirely unrelated project. Share a sensitive folder with “Everyone” on Site A, and a contractor who was only ever invited to a completely different Site B, months ago, for something unrelated, now has access too — without anyone explicitly inviting them to Site A at all. That’s rarely the intent behind picking “Everyone” in the sharing dialog, but it’s exactly what the claim actually does. Multiply that across every guest ever invited to any site in the tenant, over the tenant’s entire history, and “Everyone” ends up meaning something considerably broader than most people sharing a file would assume from the label alone.

Showing or hiding the claims with PnP PowerShell

To control whether “Everyone” and “Everyone except external users” show up as options in the People Picker, use this PnP PowerShell script:

$adminUrl = "https://mysptenant-admin.sharepoint.com"
Connect-PnPOnline -Url $adminUrl -Interactive

# Show "Everyone except external users" in the People Picker
Set-PnPTenant -ShowEveryoneExceptExternalUsersClaim $True

# Show "Everyone" in the People Picker
Set-PnPTenant -ShowEveryoneClaim $True

Flip either value to $False to hide that claim from the picker instead. Everyone except external users is the one worth defaulting to visible if either needs to be available at all — it’s scoped to internal accounts only, unlike Everyone, which also reaches already-accepted guest accounts.

Worth checking the current value before changing anything, rather than assuming a tenant’s starting state:

(Get-PnPTenant).ShowEveryoneClaim
(Get-PnPTenant).ShowEveryoneExceptExternalUsersClaim

The same settings via SPO Management Shell

The same two settings are also available through SharePoint Online Management Shell, if that’s what’s already in use:

$adminUrl = "https://mysptenant-admin.sharepoint.com"
Connect-SPOService -Url $adminUrl

# Hide "Everyone except external users"
Set-SPOTenant -ShowEveryoneExceptExternalUsersClaim $False

# Hide "Everyone"
Set-SPOTenant -ShowEveryoneClaim $False

# Show either one again by setting it back to $True
Set-SPOTenant -ShowEveryoneClaim $True

Like most tenant-level SharePoint settings, this doesn’t take effect instantly for every user everywhere — expect a short propagation delay across the tenant rather than seeing the change reflected in the People Picker the moment the command returns.

This is a visibility setting, not a security control

Worth being direct about this before treating ShowEveryoneClaim $False as a fix for oversharing: it only controls whether the claim appears as an option in the People Picker going forward. It does nothing to access that’s already been granted using that claim — a library shared with “Everyone except external users” last year stays shared with everyone in the tenant, exactly as before, regardless of what this setting is currently set to. Hiding the claim stops someone from picking it next time they share something; it’s not a switch that revokes existing grants.

ShowEveryoneClaim is a visibility setting, not a security control — hiding it from the People Picker does nothing to access already granted using that claim before the setting was changed.

Auditing where it’s already been granted

Since hiding the claim doesn’t undo past sharing, the actual governance question is finding out where “Everyone except external users” has already been used. SharePoint Online’s Data Access Governance reports answer this directly, via SPO Management Shell:

Connect-SPOService -Url $adminUrl

# Kicks off a tenant-wide report -- this runs asynchronously, not instantly
Start-SPODataAccessGovernanceInsight -ReportEntity EveryoneExceptExternalUsers -ReportType Snapshot

# Check on it and retrieve results once it's finished
Get-SPODataAccessGovernanceInsight -ReportEntity EveryoneExceptExternalUsers -ReportType Snapshot

This is the real starting point for cleaning up existing exposure — it surfaces the sites and content actually shared this way right now, which the People Picker visibility setting alone can never tell you.

Worth knowing before assuming a tenant is already safe by default: ShowEveryoneClaim defaults to $True out of the box — visible, not hidden — so a tenant that’s never touched this setting already has both claims available in the picker right now. Common guidance is to set both ShowEveryoneClaim and ShowEveryoneExceptExternalUsersClaim to $False unless there’s a specific, deliberate business need for either, since “Everyone except external users” landing in a site’s Members group with Edit permissions — sometimes without anyone realizing it happened — is enough on its own to turn a single Team site into open-edit-for-the-whole-company. A related third setting, ShowAllUsersClaim, controls a similar “All Users” claim scoped to a specific authentication provider and is worth disabling alongside the other two for the same reason.

SharePoint File Sharing: Best Practices and Approaches — the broader sharing-link picture the Everyone claims are one part of.
Check what permission a user has in SharePoint — how to check whether a specific user’s access is actually coming through Everyone/EEEU or a real group grant.
All about SharePoint Permission Roles — what a group actually granted Edit or Full Control via one of these claims can then do.

Now that’s another tip! Hope it helps somehow. Let me know if you have questions or just leave a comment if we missed something.

Happy SharePointing! #SharingIsCaring