Prevent adding "Everyone except externals" to the Owner group
It should not be possible to intentionally or unintentionally add "Everyone except externals" to the Owners. Imagine this scenario:
- Create a Group and set the Privacy settings to Public
- You later determine the Privacy should be Private
- Open the Site Permissions and then attempt to remove "Everyone" but accidentally click "Full control", the option just above "Remove"
- "Everyone" disappears from Site members so you think your site is secure
- To be sure, you now open Site information and change the Privacy settings to "Private"
In this scenario, you now have a "Private" site with "Everyone" ion the owner group. We have seen this scenario occur multiple times, making sensitive data available to everyone.
There is no business case for make "Everyone" an owner. This should simply not be possible.