• Article
  • xiv minutes to read
  • Applies to:
    SharePoint Online

Symptoms

When you utilise SharePoint Online or OneDrive for Business organization, you lot may receive one of the post-obit error messages:

  • Access Denied
  • You need permission to admission this site
  • User not found in the directory

Crusade

There are many scenarios that can prompt one of these messages. The most common cause is that permissions for the user or administrator are configured incorrectly or not configured at all.

Resolution Choice 1: Run the Cheque User Access Diagnostic

Notation

This characteristic requires a Microsoft 365 administrator account. This feature isn't available for Microsoft 365 Authorities, Microsoft 365 operated past 21Vianet, or Microsoft 365 Federal republic of germany.

Microsoft 365 admin users take admission to diagnostics that can be run within the tenant to verify possible bug with user admission.

Select Run Tests below, which will populate the diagnostic in the Microsoft 365 Admin Middle.

The diagnostic performs a large range of verifications for internal users or guests who attempt to admission SharePoint and OneDrive sites.

Resolution Selection 2: Select the well-nigh relevant pick and follow the steps to set up the issue

Note

Many examples in this article employ <contoso> as a placeholder. In your scenario, replace <contoso> with the domain that'southward used for your organisation.

When accessing a SharePoint site

  1. Make up one's mind the permission level that the user should have on the site (member, owner, and so on).

  2. Verify the permission past using the Check Permissions feature:

    1. On your site, select Settings > Site permissions.
    2. In the top ribbon, select Check Permissions.
    3. In the User/Group field, enter the user's name, and and then select Check Now.
    4. Review the permissions the user has on the site, and through which security group (if applicable).

  3. If the user doesn't have appropriate permissions, grant the user permissions to the file or site.

  4. If the user continues to receive an error message, remove the user from the site. And then grant the user permissions back to the file or site.

When accessing a OneDrive site

If the user is the owner of the OneDrive site

This effect nearly often occurs when a user is deleted and re-created with the same user principal proper noun (UPN). The new account is created by using a different Unique ID value. When the user tries to access a site collection or OneDrive, the user has an wrong ID. A second scenario involves directory synchronization with an Active Directory organizational unit (OU). If users have already signed into SharePoint, are moved to a dissimilar OU that's not currently synchronized with Microsoft 365, and then resynced with SharePoint, they may feel this problem.

To fix this upshot, delete the new UPN if it exists, and then restore the original UPN.

If you lot can't restore the original user and are still in this state, create a support request:

  1. As an administrator, select OneDrive Site User ID Mismatch, it will populate a help query in the admin middle.
  2. At the bottom of the pane, select Contact Support > New Service Request.
  3. Get out the clarification blank.
  4. Afterward the ticket is opened, provide the support agent with the UPN and OneDrive URL that's having the issue.

If the user is trying to access another user'southward OneDrive site

  1. Determine the permission level that the user should have on the site (fellow member, owner, and so on).

  2. Verify the permissions by using the Bank check Permissions characteristic:

    1. On your site, select Settings > Site Settings > Site permissions.
    2. In the pinnacle ribbon, select Cheque Permissions.
    3. In the User/Group field, enter the user'southward proper noun, and so select Check Now.
    4. Review the permissions the user has on the site, and through which security group (if applicable).

  3. If the user doesn't have appropriate permissions, grant them permissions to the file or site.

  4. If the user continues to receive an error bulletin, remove the user from the site. Then grant the user permissions back to the file or site.

When a guest is accessing a site

  1. Make up one's mind the permission level that the user should have on the site (member, owner, and so on).

  2. Verify the permission by using the Check Permissions characteristic:

    1. On your site, select Settings > Site permissions.
    2. In the height ribbon, select Check Permissions.
    3. In the User/Grouping field, enter the user'southward proper noun, and so select Check Now.
    4. Review the permissions the user has on the site, and through which security grouping (if applicable).

  3. If the user doesn't have appropriate permissions, grant the user permissions to the file or site.

  4. If the user continues to receive an error message, remove the user from the site. Then grant the user permissions back to the file or site.

  5. If there are still errors with the account, we recommend that you completely remove the guest account from the Microsoft 365 admin center. Brand sure that the user is removed from the site collection. Then grant the user permissions back to the file or site.

When a guest accepts a SharePoint Online invitation by using another account

To set this upshot, determine which account accepted the invitation, remove the incorrect account if necessary, so reinvite the user to the resource.

Step 1: Determine which account has access as a invitee

If yous can access the site as the incorrect guest, follow these steps:

  1. Sign in as the invitee account that you used to accept the invitation.
  2. Select the contour prototype in the upper right corner, and so select My Settings.
  3. In the Account field, review the e-mail accost. For example, i:0#.f|membership|JonDoe@contoso.com. In this case, JonDoe@contoso.com is the email account that accepted the invitation.
  4. If the accost is incorrect, go to Step 2: Remove the incorrect guest account.

If you tin can't access the site as the wrong guest, follow these steps:

  1. As a SharePoint Online administrator, sign in to the site collection that was shared with the guest.
  2. Select Settings > Site settings.
  3. In the Users and Permissions department, select People and groups.
  4. At the finish of the URL in your browser window, later on the people.aspx? part of the URL, replace MembershipGroupId=<number> with MembershipGroupId=0, and then press Enter.
  5. In the list of users, locate the name of the guest. Correct-click the user name, and copy the shortcut.
  6. In a new browser window or tab, paste the URL that'southward copied in step 5 into the address box. Add &force=one to the stop of the URL, and so press Enter.
  7. In the Account field, review the electronic mail accost. For example, i:0#.f|membership|JonDoe@contoso.com. In this example, JonDoe@contoso.com is the electronic mail account that accepted the user invitation.
  8. If the address is incorrect, get to Step two: Remove the wrong invitee account.

Footstep 2: Remove the incorrect guest business relationship

External users are managed from a site drove by site collection ground. A guest account must exist removed from each site collection to which the account was given access. You tin do so from the SharePoint Online user interface, or through the SharePoint Online Management Beat, depending on your version of Office 365.

For Office 365 Minor Business subscriptions, apply the SharePoint Online UI:

  1. Go to Admin > Service Settings > sites and document sharing.
  2. Select Remove individual external users.
  3. Select the users yous want to remove, and then select Delete (the trash tin can icon).

All other subscriptions must use the SharePoint Online Management Shell:

Note

This option doesn't apply to Office Small-scale Business organization (P) organizations.

  1. Download and install the SharePoint Online Management Shell. For more information, see Introduction to the SharePoint Online Management Shell.

  2. Starting time the SharePoint Online Management Shell.

  3. Type the following cmdlet:

                        $cred = Go-Credential

  4. In the Windows PowerShell Credential required dialog box, blazon your admin account and password, so select OK.

  5. Connect to SharePoint Online, so blazon the post-obit cmdlet:

                        Connect-SPOService -Url https://<contoso>-admin.sharepoint.com -Credential $cred

  6. Remove the user from each site drove. Type the post-obit cmdlet, and and so press Enter:

                        $ExtUser = Go-SPOExternalUser -filter <account@contoso.com>

    Note

    In this cmdlet, replace <account@contoso.com> with the afflicted account.

  7. To remove the user, blazon the following cmdlet, and then press Enter:

                                              Remove-SPOExternalUser -UniqueIDs @($ExtUser.UniqueId)

The steps above remove the external user's admission to SharePoint Online. Yet, the user will notwithstanding announced in people searches, and in the SharePoint Online Management Beat when you lot use the Get-SPOUser cmdlet. To completely remove the user from SharePoint Online, you must remove the user from the UserInfo list. There are two ways to achieve this.

  • Utilise the SharePoint Online UI. To do and then, scan to each site collection to which the user previously had admission, and so follow these steps:

    1. At the site drove, edit the URL past calculation the following string to the end of the URL:

      _layouts/15/people.aspx/membershipGroupId=0

      For instance, the full URL volition resemble https://<contoso>.sharepoint.com/_layouts/15/people.aspx/membershipGroupId=0.

    2. Select the user from the listing.

    3. Select Remove User Permissions from the ribbon.

  • Employ the SharePoint Online Management Shell.

    Notation

    This option doesn't apply to Small Concern subscriptions.

    1. Kickoff the SharePoint Online Management Shell.

    2. Type the following cmdlet:

                              $cred = Get-Credential

      In the Windows PowerShell Credential required window, type your admin account and countersign, then select OK.

    3. Connect to SharePoint Online, then type the following cmdlet:

                              Connect-SPOService -Url https://<contoso>-admin.sharepoint.com -Credential $cred

    4. Remove the user from each site drove. To exercise and then, type the following cmdlet:

                              Get-SPOUser -Site https://<contoso>.sharepoint.com | FT –a

      Notice the external user'due south Login Proper noun in the returned results. As an external user, information technology might take a "live.com#" prefix if information technology'south a Microsoft Account.

      Blazon the post-obit cmdlet:

                              Remove-SPOUser -Site https://<contoso>.sharepoint.com -LoginName live.com#jondoe@company.com

      Note

      Replace live.com#jondoe@company.com with the user in your scenario.

Next, remove the account from Azure Agile Directory:

  1. Download and install the Azure Agile Directory PowerShell Module and its prerequisites.

  2. Open the Azure Active Directory PowerShell Module, then run the following commands:

                        Connect-MSOLService

    Enter your ambassador credentials in the dialog box:

                        Become-MsolUser -ReturnDeletedUsers -UnlicensedUsersOnly | ft -a

  3. Locate the user that you deleted, and then ostend they're listed.

                        Remove-MsolUser -RemoveFromRecycleBin -UserPrincipalName 'jondoe_contoso.com#EXT#@yourdomaint.onmicrosoft.com'

    Note

    Supersede jondoe_contoso.com#EXT#@yourdomain.onmicrosoft.com with the specific user in your scenario.

Step 3: Articulate the browser cache

SharePoint Online uses browser caching in several scenarios, including in the People Picker. Even though a user was fully removed, the user may still remain in the browser cache. Immigration the browser cache resolves this effect. For more data about how to practice and so in Edge, encounter View and delete browser history in Microsoft Edge.

When yous articulate the enshroud, make certain that you also select the Cookies and website information selection.

Stride 4: Reinvite the guest

After you lot follow the previous steps, reinvite the guest to the site past using the desired e-mail address. To make sure that the end user accepts with the appropriate email address, it'south a best practice to re-create the link in the invitation and and then paste it into an InPrivate Browsing session. Information technology makes certain that no cached credentials are used to accept the invitation.

More than information

A guest invitation doesn't require it to be accustomed by the email address to which it was first sent. It'southward a one-fourth dimension invitation. If another user accepts the invitation, or if the user who accepts the invitation signs up by using an account other than the email accost to which the invitation was sent, you may meet an access denied message.

For example, a user is signed in through a browser by using a Microsoft account, and the user receives an email invitation to the user'south external user business relationship in the user's electronic mail application. And so, the user selects the link to accept the invitation. Nevertheless, based on the user's browser cookies, the user accidentally accepts the invitation past using the incorrect identity.

When the user signs in to the resource by using the user's external user account, the user receives the mistake that the user isn't found in the directory.

When accessing the "Admission Requests" list

To set up this issue, users must be either site collection administrators or members of the Owners group for the site. The Owners grouping must also have permissions to access the Access Requests list. Use the following solutions as appropriate for your specific configuration.

Site collection ambassador

If an affected user should be a site collection administrator, see Manage site collection administrators.

Add the user to the Owners group for the site

If the user should be a site possessor, add the user to the Owners group for the site:

  1. Equally a user who can change site permissions, browse to the affected site or site collection. Select Settings > Site settings.
  2. Select Site permissions.
  3. Select the Owners group for the site.
  4. Select New.
  5. In the Share dialog box, enter the business relationship of the user that you want to add to the grouping. And then, select Share.
  6. Verify that the user can now admission the list and approve or decline requests.

Brand sure that the Owners group has permissions to the Access Requests list

If the Owners group is inverse or removed from the Admission requests list, you must add together the Owners group permissions for the listing. Also make sure that the affected user is included in the Owners listing. To practise so, follow these steps:

  1. As a user who has the Manage Permissions Permission Level on the affected site and who besides has admission to the Access Requests list (for example, a site collection ambassador), browse to the Admission Requests listing in Internet Explorer.

  2. Printing F12 to open up the Developer Tools window.

  3. Select the Network tab, and so press F5 to enable network traffic capturing.

  4. Refresh the Admission Requests folio. After the page has loaded, printing Shift+F5 to stop capturing network traffic.

  5. In the Programmer Tools window, double-click the start issue in the URL list. This URL ends in pendingreq.aspx.

  6. In the Developer Tools window, select Response body.

  7. In the search box, type pagelistid:, and then press Enter.

    Notation

    The search highlights the pageListId text.

  8. Re-create the GUID that follows the pageListId. The GUID is between an opening brace ( { ) graphic symbol and a closing caryatid ( } ) character equally follows:

    {GUID}

    Note

    Include the opening and closing brace characters when yous copy the GUID. This GUID is the identifier for the SharePoint Online Access Requests list for your organization.

  9. In the browser address bar, enter https://<URL of affected site, or site collection>/_layouts/15/ListEdit.aspx?List=<{GUID}>, and and then press Enter.

    Note

    In this address, <URL of affected site or site collection> represents the URL for the site collection in which you want to alter the access requests (for example, https://contoso.sharepoint.com). And <{GUID}> represents the GUID that y'all copied in step 8.

  10. On the Settings page, select Permissions for this list.

  11. Make certain that the Owners grouping for the site is included in the list of permissions for the Access Requests list. If the Owners group for the site collection doesn't exist, select Grant Permissions, enter the name of the Owners group for the site in the Share dialog box, then select Share.

  12. Follow the steps in the Add together the user to the Owners grouping for the site section to brand certain that the user is included in the Owners group.

More information

This result occurs considering only site collection administrators or users who are members of the Owners grouping for the site collection have permission to approve or decline pending requests in the Admission Requests list. For situations in which users are members of the Owners group for the site, the Owners group must also take Full Control permissions to be able to access the Access Requests list.

For more information well-nigh how to gear up and manage access requests, run into Set and manage admission requests.

For more than information about how to use the F12 developer tools, run into Using the F12 programmer tools.

When accessing a shared binder

To work around this outcome, use one of the following workarounds every bit appropriate for your state of affairs:

  • Share individual files but not folders.

  • Share a whole site collection or subsite.

  • If your site doesn't crave Limited-access user permission lockdown way, deactivate this site collection characteristic.

    Note

    Other features such every bit publishing may require this characteristic to piece of work correctly.

When yous share a folder with a user who tin't access the parent folder or site, SharePoint assigns the user limited access to the parent items. Specifically, SharePoint allows the user to access the folder without obtaining permission to admission the parent folder and other items (other than limited access). Even so, later on Limited-access user permission lockdown style is enabled, the user doesn't accept admission to the binder because the necessary limited admission permission on other items no longer works correctly.

What'south "Express Access" permission?

The Limited Access permission level is unusual. It lets a user or group browse to a site page or library to access a specific content detail without seeing the whole list. For example, when you share a single item in a list or library with a user who doesn't have permission to open or edit whatever other items in the library, SharePoint automatically grants limited access to the parent list. It lets the user see the specific item that you shared. In other words, the Express Access permission level includes all the permissions that the user must take to access the required particular.

For more information about site collection features that includes Limited-access user permission lockdown mode, meet Enable or disable site collection features.

When a user tries to approve an Blessing Workflow task

To gear up this issue, grant Edit access to the specific chore list for the workflow to the afflicted user.

Additionally, the user who is approving the item as office of the workflow must likewise have Read admission to the detail that'southward the target of the workflow.

This behavior is past design. Users who try to approve a SharePoint 2010 Approval Workflow chore, but who take only Edit permissions to the task list item, can't view the task'due south course page. The user must take at to the lowest degree Read access to the workflow task list.

For more data about approval workflows, meet Empathise approval workflows in SharePoint 2010.

For more information well-nigh permission levels in SharePoint Online, run across Understanding permission levels.

Yet need aid? Go to SharePoint Customs.