Forum Discussion
SharePoint security broken between Microsoft 365 group and SharePoint group
Hi,
Users are giving Member privilege through Teams, which gave them Member privilege in the Member SharePoint group. All good for 99% of the company.
PROBLEM : I have 4 users without access to the SharePoint by this method. Security is not broken between Microsoft 365 Group and SharePoint group and is working fine for everybody else. Strangely, I saw that these 4 users are members of more than 1500+ Microsoft 365 Group, since they have been in the business for a long time and touch many projects here). I heard the limit is 7000 but they still have problem.
Using the "Check permission", I got "None" for these people, but "Edit - Given through the XYZ Member group" for every other people in the Microsoft 365 Group.
Any advice ?
Thanks !
Patriccote
4 Replies
If you're referring to those Private channel sites when users are members of the private channels get removed from the "Members" sharepoint group then its worth checking those users' RecipientTypeDetails and ensure they are not SharedMailboxes.
If they are, convert to UserMailbox and see the issue persists.
Had a few clients > they checked and found that to be the case > the suggestion fixed the issue for them.Hi TheChosen1 !
I have no Private channel associated with this Microsoft 365 Group / SharePoint, I don't even have a Teams. I have also thousands of these Microsoft 365 Group / SharePoint combinaison, and no problem with them. Only 4 users who seem to lost access after they have been initialy granted the right to some of them.
Hi Coralie!
Thanks for you last message! Here's my answers:- whether they are actually members of the Microsoft 365 Group in Entra ID;
ANSWER : Yes, actual member of the Microsoft 365 Group under https://portal.azure.com - whether the issue can be reproduced in a brand-new test Team;
ANSWER : From an older SharePoint site, the invitation worked. From a recent site, strange result (see my last answer below) - their total number of direct and transitive group memberships through Microsoft Graph;
ANSWER : Don't know through Microsoft Graph. From Azure : group membership : 1 622.
- whether there are any differences compared to a user who works correctly (UPN history, guest/member status, synced account, etc.).
ANSWER : Did not search enough on that subject, but it is something to look into. - Have you tried removing and re-adding one of these users to the Microsoft 365 Group, then waiting for membership propagation before testing again?
ANSWER : Yes, did that. Initially, the user did not even see the team under Teams, so I remove completely her access using Admin SharePoint, and gave her access again. Did receive the email from Microsoft, still cannot see the team under Teams BUT now have access to the SharePoint ... ?!? Furthermore, I added her to a new Microsoft 365 Group, she received the email, have access to the SharePoint BUT still cannot see the team under Teams. Very strange, different from what happened in the past. Will look again after the week-end.
- whether they are actually members of the Microsoft 365 Group in Entra ID;
Hello,
The most interesting detail is that "Check Permissions" returns "None".
In a Teams-connected SharePoint site, Microsoft 365 Group members should automatically inherit SharePoint permissions through the site's Members group.
Since the issue only affects 4 users, I would focus first on the affected accounts rather than on the Teams/SharePoint connection itself.
I would check:
- whether they are actually members of the Microsoft 365 Group in Entra ID;
- whether the issue can be reproduced in a brand-new test Team;
- their total number of direct and transitive group memberships through Microsoft Graph;
- whether there are any differences compared to a user who works correctly (UPN history, guest/member status, synced account, etc.).
Have you tried removing and re-adding one of these users to the Microsoft 365 Group, then waiting for membership propagation before testing again?
The fact that they belong to more than 1,500 groups is a credible lead. While this is not a documented SharePoint limit by itself, Microsoft does document that authorization behavior can become unpredictable when the total number of group memberships becomes very large.
If "Check Permissions" still returns "None" after confirming that the user is a valid member of the Microsoft 365 Group, I would investigate further into either a group membership evaluation issue or an anomaly specific to those user accounts.
Hope this helps point you in the right direction. Let me know what you find.
