Remove SharePoint View Access to Specified Users

Question

Hello, I have an internal SharePoint site that is currently set that Everyone Except External users can access to view. I have a group of about 10 users I would like to completely block from viewing any pages on the SharePoint site. I believe they are a part of the 365 account, but I need to confirm that. How can I remove these users from viewing the SharePoint site?

Answer 1

Hi Beckham,

Thanks for posting in the community. We are happy to help you.

According to your reply, you don't need to try the suggestions in my previous reply. Please contact your admin or IT department and ask them to try the steps in this article: Block access to SharePoint for specific users.

We look forward to your response. Thanks for your cooperation. 

Sincerely, 

George | Microsoft Community Moderator

Answer 2

Hello,

The group I want to restrict I actually want them to have no access to any SharePoint site within the organization. Based on this, would you still suggest option 2 as the best way to go?

Thanks

Answer 3

Hi Beckham,

According to your description, since the site has a group "Everyone Except External", I assume the site is a public team site and you want these users can access other SharePoint sites. If so, based on my search, here are two methods. Please check if they meet your requirement.

1. You will have to change the public site to "Private", and then add all internal users except the specific users to this site.

Here is one way to bulk-add users to a group.

a.  Please contact your admin/IT department to go to Microsoft 365 admin center and export all user information.

b. Please download the template CSV file, and add all users except the specific users to the CSV file.

c. Contact your admin and let them run the following PowerShell script. Please edit the Import-SPOUserFromCSV parameters, then run this script. The script is from SharePoint Diary.

#Load SharePoint CSOM Assemblies

Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll"

Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"

Function Import-SPOUserFromCSV($CSVFile)

{ 

    #Get data from CSV

    $UserData = Import-CSV $CSVFile

    #Get Credentials to connect

    $Cred = Get-Credential

    ForEach($Row in $UserData)

    {

        #Get Data from CSV

        $SiteURL = $Row.SiteURL

        $GroupName= $Row.GroupName

        $UserAccount = $Row.UserAccount

        Try {

            #Setup the context

            $Ctx = New-Object Microsoft.SharePoint.Client.ClientContext($SiteURL)

            $Ctx.Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($Cred.UserName,$Cred.Password)

            #Get the Web and Group

            $Web = $Ctx.Web

            $Group= $Web.SiteGroups.GetByName($GroupName)

            #Resolve the User

            $User=$web.EnsureUser($UserAccount)

            #Add user to the group

            $Result = $Group.Users.AddUser($User)

            $Ctx.Load($Result)

            $Ctx.ExecuteQuery()

            write-host  -f Green "User '$UserAccount' has been added to '$GroupName' in Site '$SiteURL'"

        }

        Catch {

            write-host -f Red "Error Adding user to Group!" $_.Exception.Message

        }

    }

}

#Call the function

Import-SPOUserFromCSV "C:\Temp\UserData.csv"

2. If you don't want to change the public site and bulk add users to the site, please contact your admin/IT department to create a Conditional Access policy in Azure Portal and apply the policy to these users, create a sensitivity label, apply the label to the site.

For your reference:

Block or limit access to a specific SharePoint site or OneDrive

We look forward to your response. Thanks for your cooperation.

Sincerely,

George | Microsoft Community Moderator

Answer 4

Maybe you can revoke their SP licenses? There's no permission level to deny access (sadly).

Answer 5

Hi Beckham,

Thanks for posting in the community. We are happy to help you.

From your situation, we need to do some tests first on our side, we'll appreciate it if you can understand that it will take some time to give you more effective suggestions according to the test result. We will update our reply as soon as possible.

Thanks again for your understanding and cooperation.

Sincerely,

George | Microsoft Community Moderator