Office 365 Security Group not working in SharePoint Online access

Question

Hi MSFT Support Team,

I have some issues with using Office 365 Security Group to access SharePoint Online Resources.

Context for a minimal test case:

1. As a Global Admin, I created a brand new SharePoint Online Site Collection, keeping all the default SharePoint Groups.
2. In Office 365 Admin Center > Groups > I created a Security Group.
3. In Office 365 Admin Center > Users > I created a new user and assigned it with a valid SharePoint Online license.
4. I added the new user to the security group.
5. I added the security group to the Team Site Owner Group in new SharePoint root site of the new site collection.
6. I logged in as the new user to outlook.office.com, I could send emails, but when I tried to login to the SharePoint site, I got access denied page.
7. I logged in as Admin again, and added the new user to SharePoint Team Site Owner Group separately.
8. I logged in as the new user to the SharePoint site, I could access the site.

Even if I replace step2 with: In Office 365 Admin Center > Admin > Exchange > Recipients > Groups > I created a Security Group, again, not working.

It made me feel like Office 365 Security Groups/Exchange Online Security Groups are not working on SharePoint Online, at least not as I expected.

Looking forward to hearing from you on this issue. Thanks a lot.

Ares Liu

Answer 1

Hi Ares,

I'd like to confirm the following information regarding the issue:

1. Please make sure that you are trying to login to the site collection directly (e.g. domain.sharepoint.com), not a subsite or a list/library included in it. This is because the permission settings for these places can be different.

Also I'd like to know if you have recently deleted the "everyone except external users" or "everyone" in a group when setting up the new group.

2. I'd like to know if the "Read" permission level has been modified:

Browse to https://domain.sharepoint.com/_layouts/15/editrole.aspx?role=Read

Under "Site Permissions", check if the following items are ticked:

-Use Self-Service Site Creation

-View Pages

-Browse User Information

-Use Remote Interfaces

-Use Client Integration Features

-Open

3. If it is not the case and the issue persists, please provide the tenant information with us via Private Message for further help: https://community.office365.com/user/conversations

Best Regards,

Jim

Answer 2

hi ares liu,

we can use security groups to control permissions for our site by adding security groups to sharepoint groups and granting permissions to the sharepoint groups. we cannot add distribution groups to sharepoint groups. for more details. please refer to the article: https://technet.microsoft.com/en-us/library/cc261972.aspx.


from your description, i noticed that the security group is created and added to sharepoint group newly. therefore, could you wait some time to check the result or add an old decurity group into the team site owner group?

if the issue persists, to find the root cause, i would like to confirm the following details:

1. about “when i tried to login to the sharepoint site, i got access denied page”, could you share with us a screenshot about the message you run into when accessing the team site? to upload images, please click use rich formatting when replying to the post, then click the insert/edit media icon.
2. could you check if the user and the security group have full control permission at the site level and share with us the screenshots?

to check the user or group permission, please go to the top level site and click the settings icon like a gear > site settings > users and permissions > site permissions > check permission > type the user account or the group into the box > check now.

regards,

shirley

Answer 3

hi ares liu,

glad to hear that it is working now.

regarding the other question, generally, users with read permission can view the sharepoint site pages instead of contribute permission. for your reference:

understanding permission levels


for the situation you encountered, for us to better understand the situation and look into the issue, could you help clarify the information below?

1. do you refer to the everyone except external users group for your “all users (membership)”?
2. does the issue happen to the newly created users?
3. would you provide us some related screenshots for our reference?

note: to insert a screenshot, please click on use rich formatting and select the insert image icon.

regards,

allan

Answer 4

Hi Shirley,

It might be the lag, around 10 minutes after I sent the post, it was working. Thanks.

But do you know why at least Contribute permission needed to access SharePoint Search Site Collection (the default one when you sign up for Office365, I know by default the All Users (membership) is there with Read permission, but it's not working for our client, so I have to create another group with Contribute permission and add a Security Group there)? Thanks again.

Ares Liu

Answer 5

Hi Ares Liu,

Are you still experiencing the issue? Do you need further assistance?

Regards,

Shirley