How long for SharePoint online to sync new permissions

Question

Dear experts,

We are using Office 365 and SharePoint Online, we have a doc center where we set all the members in our Staff group will have view permission.
We added a new member into Staff group from on-prem AD, normally in my judgement, it takes up to 0.5 hour for the update to be in sync with Azure AD then it should reflect to SharePoint.
However it seems not working this way.

Is there any official saying, when we added new member from local AD, how long it takes for him/her to view the doc at SharePoint online?
Thanks a lot!

Answer 1

Hi Eaven,
According to Microsoft Learn the default sync time is 30 minutes, as you’ve observed.
Be careful changing this if you have a slow network connection or large volumes of changes per sync cycle.
how-to-connect-sync-feature-scheduler

Answer 2

Hi @Eaven HUANG ,
As DavidBroggy-5270 said, The new default synchronization frequency is 30 minutes.

Here is the official documentation for your reference.

Thanks,
Yanli Jiang

===========================================

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

I don't think the answers really address the question so let me re-phrase it.

I am using an AD security group to provide access to a sharepoint document library.
The AD security group is synced; it's part of the AD sync.
I remove a member from the security group.
I wait 35 minutes.
I check the group online in the o365 admin center, and I confirm that the user is indeed gone from the security group.
But the user STILL has access to the Document Library. When I go to the doc library and use the "check permissions" button, and put in the username, and click check permissions, it says they STILL have access from the security group that I removed them over 35 minutes ago.

So I think the question is, after the security groups/users have been synced and are up-to-date on o365 (online) then how long before SharePoint actually recognizes that? I can tell you for sure it's over 1.5 hours. I've been testing it today. I also forced an "initial" AD sync via Powershell, so the 30 minute delay doesn't apply to my situation.

I'm 1.5 hours into this, and SharePoint has not recognized the updated security group membership yet, although the security group has shown accurate online for the entire time.

Answer 4

Not sure what Oscar F is referring to in his comments/situation but I am seeing exactly what Jonathan is reporting. I have a site with the default SP groups, an AD group was added months ago to the visitors group for the site. Today I added a test user account to the AD group which I can see has synced with Azure (user is listed as a member) but the user can NOT access / see documents in the library. Waited at least 60-90 min. BUT if I add the same user directly to the same SP Visitors group he instantly has access. Remove the user from direct SP group and access is gone. Is this the new reality for using Cloud products, make a permission change and wait 24hours to see if it worked and is what you want then if not make another change and waiting again?

Answer 5

I never found an "official" answer, but in our environment it seems to take around 8-12 hours. We now just wait overnight for changes like this before we do any real testing or get concerned about it.

Thanks,

JL