Forum Discussion
Users unable to determine who has access to document library due to security groups
I don't think the issue is the use of Entra ID security groups. In fact, using groups is generally the preferred approach because it simplifies onboarding, offboarding, and requests such as "Give UserB the same access as UserA."
The challenge is that SharePoint users can see the group assigned to a folder, but they often cannot easily see the members of that group. As a result, they don't know who currently has access to the content.
Rather than abandoning security groups, I would address the visibility problem.
One option is to implement an Access Matrix using a SharePoint List.
Create columns such as:
- Security Group Name - Text Column
- User - People Column
For example:
sec-Accounting-FiscalYear2024 | Virendra Kumar
sec-Accounting-FiscalYear2024 | TonyTech2026
sec-Accounting-AP | Virendra Kumar
OR
sec-Accounting-FiscalYear2024 | Virendra Kumar, TonyTech2026
sec-Accounting-AP | Virendra Kumar
To keep the list up to date, you could use a service account and a scheduled Power Automate flow (daily or weekly) that:
- Reads membership from Entra ID security groups
- Compares it with the SharePoint list
- Adds newly assigned members
- Removes users who are no longer in the group
This gives users a self-service reference for "Who has access?" without requiring them to inspect Entra ID groups directly.
Alternatively, if you want to manage it manually, create a simple Access Matrix in Excel, a SharePoint page, or a document that maps security groups to users. Users can then refer to that matrix rather than trying to determine access through SharePoint permissions.
Ultimately, this is more of a governance and change-management challenge than a SharePoint permissions issue. The Entra ID security groups should remain the source of truth for permissions, while the Access Matrix provides end users with a simple way to understand who has access to what.