How to find sites open to everyone in SharePoint Online

Before you start

Use an account with the SharePoint Administrator role. To read a site's users with Get-SPOUser, Microsoft says the account must be at least a SharePoint Online administrator and a site collection administrator of that site, so the script can't read a site where you aren't one and lists it as not read. In PowerShell 7 the SharePoint Online Management Shell loads through Windows PowerShell, which the last line of the install block does.

The script reads every site in turn, so it's slow on a large tenant. OneDrives are left out. The examples read and export and change nothing.

Option 1

Find sites open to everyone with PowerShell

Install the module once, then connect and read the users of each site. The connection prompts you to sign in. Replace contoso with your tenant's name.

# Install once, if the module is not already installed.
Install-Module Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser
# In PowerShell 7 only: load the module through Windows PowerShell.
Import-Module Microsoft.Online.SharePoint.PowerShell -UseWindowsPowerShell

$ErrorActionPreference = 'Stop'
$claims = 'Everyone', 'Everyone except external users'
Connect-SPOService -Url 'https://contoso-admin.sharepoint.com'
try {
    $rows = [System.Collections.Generic.List[object]]::new()
    foreach ($site in Get-SPOSite -Limit All) {
        try {
            $users = @(Get-SPOUser -Site $site.Url -Limit All)
        } catch {
            $rows.Add([pscustomobject]@{ Url = $site.Url; Claim = 'Not read'; Groups = "$_" })
            continue
        }
        # Keeps a claim only where it's in 1 of the site's groups.
        foreach ($user in $users | Where-Object { $_.DisplayName -in $claims -and $_.Groups }) {
            $rows.Add([pscustomobject]@{ Url = $site.Url; Claim = $user.DisplayName
                Groups = $user.Groups -join '; ' })
        }
    }
    if ($rows.Count -eq 0) {
        Write-Output 'No site holds Everyone or Everyone except external users in a group.'
    } else {
        $rows | Sort-Object Url, Claim |
            Export-Csv -Path './sites-open-to-everyone.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) rows written to sites-open-to-everyone.csv."
    }
} finally {
    Disconnect-SPOService
}

Each row names a site, the claim and the site groups that hold it; a site you couldn't read has Not read and the error instead. The script finds a claim by its name and only where it's in a site group, so a claim given a permission directly, or on 1 library or file, isn't in the file. A claim in a group with no permission on the site reaches nothing, so check the group before you act.

Option 2

Run the site permissions report in the SharePoint admin centre

1. Sign in to the SharePoint admin centre as a SharePoint Administrator.
2. Expand Reports and select Data access governance.
3. Under Site permissions across your organization, select View reports, then Create report. Microsoft says the first report takes up to 5 days, later ones up to 24 hours, and a report can run again every 30 days.
4. When it's ready, select View report under SharePoint, and download the CSV.
5. Sort the CSV by EEEU permission count and Everyone permission count. Any site above 0 is open to that population somewhere.

This suits a tenant with SharePoint Advanced Management, and it counts permissions at every level, files and folders included. With Microsoft 365 E5 alone, Microsoft says the snapshot reports aren't there, so use PowerShell or a report instead.

Common questions

What's the difference between the 2 claims?

Everyone except external users is a built-in group of every person in your organisation, with guests left out. Everyone covers all users, guests included, so it's the wider of the 2.

Why does Microsoft's report count a site the script doesn't list?

The site permissions report counts permissions at any level, so a claim given access to 1 library, folder or file counts. The script reads only the site's own groups.

How do I find sites that allow Anyone links?

Anyone links open without signing in at all, which is wider again. See how to find sites allowing Anyone links in SharePoint Online.