Sign in with Microsoft
Sign in or create an account.
Select a different account.
You have multiple accounts
Choose the account you want to sign in with.


This article describes how to understand the extent of the "Everyone" permission that's used in your organization.

More Information



  • Your Microsoft 365 organization is Contoso. Your organization uses for SharePoint sites and groups, and for OneDrive storage.

  • You are an administrator for the organization with the identity of


  1. Configure your tenant to grant the Everyone claim to external users if they're not set already. To do this, run the following cmdlet: 

    Set-SPOtenant -ShowEveryoneClaim $true

  2. Browse to, and then sign in by using your credentials.

  3. Locate the Site Collections tab in the Admin Center.

  4. Create a new site collection by using the URL

  5. Browse to the site

  6. Click Share, type the address, and then click Send to send an invitation to the account.

  7. Sign in to the consumer account on a separate computer or by using an in-private browser session.

  8. Click the link in the email invitation, and then sign in by using the account. The external user now has access to this site.

  9. Open the SharePoint Search Query Tool.

  10. In the Connection section, type the following:

    SharePoint Site URL:

    Authentication: Authenticate by using a specific user account

    Authentication Method: SharePoint Online

  11. Click Sign In.

  12. When you are prompted, type the credentials for the consumer account 

    In Query Text, type path:

    This constructs a query as follows:'path:'

  13. Click Run to execute the query.

  14. View the Primary Results tab. This lists the content to which external users have access under the root site of your tenancy. Ignore the results from the site to which they were invited (

  15. Repeat the query by using the following Query Text to review access to OneDrive content:


The results will include access to some system ASPX pages that have no content. Those pages can be ignored.

Then, you can investigate any results individually to determine whether they are permissioned correctly.


For more info about how to govern access of external users in Microsoft 365, refer to the following Microsoft Help article: 

4089534 How to govern access of external users in Microsoft 365

Need more help?

Expand your skills


Get new features first


Was this information helpful?

What affected your experience?

Thank you for your feedback!