Forum Discussion
SharePoint search results showing for those without permission to the documents
We have documents in a restricted SharePoint library that are appearing in searches (at both the site and organization level) for users who do not have access to the library. The users aren't able to actually open the documents, but seeing the titles and even a brief blurb in the search results is enough of a security breach for us.
I reached out to M365 Support and they advised going to Library settings > Advanced settings > Search and toggling the 'No' option for the restricted document library. However, this restricts the documents in the restricted library from being searchable entirely, even those who should have access, which is obviously not ideal.
Does anyone know if this is normal behaviour, or how to troubleshoot?
After nearly a month into a ticket with Microsoft, unfortunately I do not have an answer outside of reindexing the library and/or reindexing the site. The issue has resolved for us, but I never received an answer to why it was happening in the first place, or what exactly was done to resolve it.
This was all done on a test library, on a test site, with very minimal content. Permissions were adjusted on the library, but only as per the instructions shared by Microsoft (see Customize permissions for a SharePoint list or library).
My best guess is that indexing is necessary any time permissions are changed on a document library - but the lack of clarity on how to avoid this issue and the fact that it is a pretty massive security risk when dealing with any amount of personal information is concerning.
That is scary. Thank you for sharing the update.
Perhaps the library was indexed before permissions were set or there are documents with unique permissions or current/previous sharing links? Doublecheck your library to ensure there are no custom permissions on folders/files. Then re-index the library in the library settings. It may take 24-48 hours for the results to disappear from search.
This is not normal behavior. This is the antithesis of how those search results are supposed to work.
Do you know if you have devs at your company who have customized search?
Have you already gone into the library permissions and used the 'Check Permissions' button to triple-check user's permissions? And checked all the unique permissions?
If there's no custom search and the perms check out, I'd be inclined to create a new library and put some no risk docs in there and test the permissions there.
I have the same problem. As a user without access to the HR Sharepoint site, I can see documents from that site in my search results, complete with a random sentence from inside each document. I definitely don't have access as the user, and clicking on the file brings up the page to request access. But I shouldn't be able to see a sentence from the file, or even the file name.
Nobody has customised the search or done anything fancy - we are a small charity without those kind of resources.
I'm having a very similar issue with a client. They reported users performing a search in Outlook (thick client) are seeing items they shouldn't. I was able to replicate this with a test account. Items showing up, but when clicked on would bring us to the standard "request access" page.
Maybe Microsoft is doing something on the backend and broke permission trimming on search results?
