3,705 questions
You cannot, profile pictures are not exposed externally/without authentication.
How to allow external/guest users to view profile pictures
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 41%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBK%3C/text%3E%3C/svg%3E)
B, Kyle
1
Reputation point
We're using SharePoint Online as a portal for our clients, who have been invited to our Azure environment, and would like the clients to be able to see the Office 365/Outlook profile pictures of our employees. I'm using PnPjs to retrieve the photo and it works fine when our employees are logged in. They can view profile pictures of other employees. When a client is viewing the SharePoint site, PnPjs throws a 401 Unauthorized error when retrieving the picture.
I parsed the token while logged as a test external account (using an @harsh.com .com email but the clients will be using their company email) and the token has the following scopes
User.Read
User.Read.All
User.ReadBasic.All
profile
openid
in Azure, our Guest User Access is set to "Guest users have limited access to properties and memberships of directory objects".
Is there something I'm missing? Or is this how it's supposed to work? Thanks.
Microsoft 365 and Office | SharePoint | Development
2 answers
Sort by: Most helpful
-
Vasil Michev 119.5K Reputation points MVP Volunteer Moderator2022-05-10T07:51:47.343+00:00 -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(3.2, 14.000000000000002%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESV%3C/text%3E%3C/svg%3E)
Stephan Valkær 0 Reputation points2023-10-09T09:24:00.06+00:00 And that is not the fact when using live feed video?
Sign in to comment -
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(252.8, 5%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
RaytheonXie_MSFT 40,471 Reputation points Microsoft External Staff2022-05-10T08:44:58.643+00:00 Hi @B, Kyle ,
As far as I know, there is no such function for external users to access user profile. External users can only share with documents, data, and lists. The highest permission of external user can't access sharepoint admin center user profile too. You can refer to following documents.
https://learn.microsoft.com/en-us/microsoft-365/solutions/collaborate-in-site?view=o365-worldwide
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
-
B, Kyle 1 Reputation point
2022-05-10T11:13:36.077+00:00 Thank you for your response. I saw this Graph API article about getting permission without a user Can I use this method in C# in an ASP.NET MVC Web API to retrieve the picture using server side code instead of on the client via PnPjs? As you can see from the scopes in my previous comment, we have already added the User.Read.All Application permission but I don't see anything in the documentation that says I can get the photo with that scope.
-
RaytheonXie_MSFT 40,471 Reputation points Microsoft External Staff
2022-05-11T08:04:20.277+00:00 Hi @B, Kyle ,
It's not possible to get all user's profile by external user. If you want to grant User.Read.All permission, you need to rely on an administrator account. External user can't be granted administrator permission. -
B, Kyle 1 Reputation point
2022-05-12T20:28:07.68+00:00 @RaytheonXie_MSFT Are you sure it's not possible? Why does this link say that the default guest permission allows it to read photos? https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions
Read display name, email, sign-in name, photo, user principal name, and user type properties of other users and contacts
Also, several people in this thread said it worked before and then stopped working at one point. One of the Microsoft forum employees said they were able to recreate the issue and were going to talk to the team about it. That was back in December. https://learn.microsoft.com/en-us/answers/questions/671372/unable-to-retrieve-photos-from-the-graph-api.html
I have reproduced your problem using a guest user. I think this is an unknown error and I need to discuss it with the team.
-
RaytheonXie_MSFT 40,471 Reputation points Microsoft External Staff
2022-05-17T08:50:42.347+00:00 Hi @B, Kyle ,
Guest users have more permission than external users. Guest users permission will have access to users properties in sharepoint. -
B, Kyle 1 Reputation point
2022-05-17T12:50:16.08+00:00 @RaytheonXie_MSFT That is extremely confusing. The title of the section in Azure where you can change guest settings says "External users". So this settings has nothing to do with external users and only guest users?
-
B, Kyle 1 Reputation point
2022-05-17T13:11:57.897+00:00 @RaytheonXie_MSFT Sorry for the second reply. Maybe I have been using the wrong terminology. The accounts that I am having issues with are already "Guest" accounts. When I go to the Active Directory Users section in the Azure portal it says "Guest" in the user type column. When I log into a SharePoint online site with this user I am unable to view the photo of an internal user.
Sign in to comment -