Forum Discussion
Visitors gaining access even though they aren't approved?
ww-mn It's alarming that unauthorized users can access your SharePoint team site without explicit approval, potentially jeopardizing security. The anomaly of users appearing in the Visitors group without being listed is concerning.
Start by reviewing Site Permissions, ensuring only authorized users are in the Visitors group and checking for unusual permissions. Examine Permission inheritance to see if it unintentionally grants access to the Visitors group. Analyze user accounts for unusual access tokens or shared credentials granting unauthorized access.
Conduct a security scan of the SharePoint environment, looking for vulnerabilities. Check access request history for any recent unauthorized grants. Implement user activity monitoring to identify suspicious access attempts. Configure stricter access controls, requiring explicit access requests even for visitors.
Educate users on proper access practices and the importance of reporting unauthorized access. Use SharePoint tools like Access Audit to monitor and investigate user behavior.
If challenges persist, consult SharePoint security experts or Microsoft support for in-depth analysis and guidance. By taking these steps, you can effectively address unauthorized access and enhance the security of your SharePoint team site.
We aren't sure how it ended up in there because none of us in our departments managers added it. Our org requires our top level content and knowledge managers to be part of our owners groups even if they aren't part of our department, so our only guess is they were messing around with something and added it without us knowing, possibly without them even realizing it. Regardless, we found it, removed it, and all is well again.
ww-mn It's good you were eventually able to identify the root cause of the unauthorized access to your SharePoint site - the "Everyone except external users" group being erroneously added to the Visitors group. Even if done accidentally by a top-level content manager, it likely happened through tinkering with permissions without understanding the broader implications.
While you've addressed the immediate issue by removing that group from Visitors, a few additional steps could help prevent such accidents in the future.
Lock down permission settings so only Site Owners can modify access groups. This prevents unintended changes. Implement an approval workflow for permission changes so multiple owners validate additions. Extra guardrails. Expand on the audit capabilities to track permission and access changes by user. Improves accountability.
Better educate content managers on your access approval processes and how groups relate to inheritance. Reduces guesswork. It's an understandable oversight given the complexity of SharePoint permissions.
But doubling down on change controls, auditing, and security training makes unwanted modifications less likely moving forward. Keep making incremental improvements to tighten up administration and prevent confusion over who should have access.