Access denied error when creating Asset library Add-SPOOrgAssetsLibrary

[wkwolff]

My Global Admin and my role as SharePoint admin get this error below when trying create Org Asset Library. The documentation says both roles should be able to create this library. I'm not if there is some kind of policy or security feature we have enable that might be blocking this?

Running below script:

Add-SPOOrgAssetsLibrary -LibraryUrl https://mySP.sharepoint.com/sites/Marketing/Assets -ThumbnailUrl https://mySP.sharepoint.com/sites/Marketing/Assets/logo.png -OrgAssetType ImageDocumentLibrary

Error:

Add-SPOOrgAssetsLibrary : Access denied. You do not have permission to perform this action or access this resource.
At line:1 char:1
+ Add-SPOOrgAssetsLibrary
+ ~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Add-SPOOrgAssetsLibrary], ServerUnauthorizedAccessException
+ FullyQualifiedErrorId : Microsoft.SharePoint.Client.ServerUnauthorizedAccessException,Microsoft.Online.SharePoi
nt.PowerShell.AddSPOOrgAssetsLibrary

[#2]

Hi - I'm getting the same error, could you let me know if you were able to fix it please?

thanks,

Tom

[#3]

I also have the same issue.

Will post the answer here if I discover the root cause. Please do the same if you find it first.

Stephen

[#4]

@wkwolff and @tommalt - I was able to get past that error message using the following two steps.

1. Global Admin access is apparently not sufficient. The user account running this PowerShell script must also have Owner access to the relevant library!
2. Need to have already granted Read permission to "Everyone except external users" to the document library. Otherwise you get the error “Add-SPOOrgAssetsLibrary : "Everyone except external users" needs to be given read permission to the document library. For more information, see Create an organization assets library - SharePoint in Microsoft 365 | Microsoft Docs.

Hope this helps someone.

[#5]

@Stephen Minhinnick Hi. This is an older discussion by now but I have the same problem.

Before looking this up I had already done what you mentioned except I'm unable to reach the settings where one can "grant Read permission to "Everyone except external users" to the document library." There are the "very classic looking" old library settings that do have a separated group called as "Everyone except external users" but that group, just like every other group there, has no parameters/attributets/etc to edit besides delete or "add a file" (for some reason).

[#6]

@MaPikka 

Here is a step-by-step guide on how to add "everyone" to the correct permissions group. Forgive me if these instructions are too simple, but I am putting them up for anyone.

>>> You first have to be an Owner of the particular SharePoint Site to do this.

1. Navigate to your SharePoint site, then navigate into your Document Library that you want to make an organization assets library.
2. Click on the Settings cog, then navigate to Library settings > More library settings > Permissions for this document library.
   (The library may inherit permissions from its parent or else have unique permissions. Either is fine.)
3. The library will typically have at least three permissions groups, one each for Owners, Members and Visitors. The Visitors group should have "Read" permissions.
4. Click on name of the Visitors group to navigate into it.
5. If it has "Everyone except external users" listed as a member of this group, then Visitor permissions are already correct. You don't need to do anything more.
6. If it does NOT have "Everyone except external users" listed, click on New.
7. In the first box type "Everyone". Click on the displayed item titled "Everyone except external users" to select it, and then click Share.
8. The Visitors permission group will now include "Everyone except external users".

I hope this helps. Let me know if I have misunderstood your issue.

[#7]

@Stephen Minhinnick If I try to add "Everyone except external users" to the visitors group it is not found in the pick-list (see below)- I tried enabling this claim using the "Set-PnPTenant -ShowEveryoneExceptExternalUsersClaim $True" command (since it was set to False), but it's still not letting me do it.  Is there a way around this?