I have a question about the default value of “Everyone except external users” in our O365 My Sites environment. It appears that every My Site that is provisioned has “Everyone except external users” on the Permissions tab. I didn’t realize that until I found, after adding an App, (it inherited the “Everyone except external users” permission) the content of that app was visible to everyone in the tenant. In the example case, all the content in the Doc Library that was added, was readable by everyone. A similar situation exists when the users add a sub-site… although they can choose not to inherit permissions, they usually do, not knowing about the “Everyone except external users” in the parent My Site settings. I know the user can go back to the App or Sub-Site and remove that permission, but is that a practical way to manage it when thousands of new accounts are created each year.
Looking at the admin console I see that “Everyone except external users” appears in two places.
First I see it here: [Permissions for User profile] “Use these permissions to control who can create My Sites…” I think this is used to determine if the current user can be provisioned with a My Site account.
The second place is here: [Read Permission Level] “Enter the accounts that will be granted the Read permission level in the personal site when it its created”
Removing “Everyone except external users” from the Read Permission Level allowed me to provision a new user My Site without “Everyone except external users” in the My Site Permissions tab. It appears to fix the problem (for new accounts).Is there a downside to this? I can still find my new account through People search, see their picture, Follow them and see a doc if it is put into the Shared with Everyone folder in their OneDrive. What I cannot see is any Apps or Sub-Sites that were added to that My Site account.
Thanks for your input.
Jim
04/28/2014:
Hemendra, I see you moved my question to this forum. So far I see 128 view but no replies.
Since the question involves default values in the Admin Console and the effect on My Site security, would it be better in the Sharepoint 2013 Setup, Upgrade, Administrations and Operations forum?
Regards,
Jim