SharePoint "Access Denied" and "You need permission to access this site"
These errors mean SharePoint refused the request for the account that was used. Microsoft lists the messages people see: "Access Denied", "You can't access this item", "You don't have permission to access this item", "You don't have access to this file", "You need permission to access this site" and "User not found in the directory". For a shared link the message is "This link is not available to you".
Microsoft says the errors can occur for various reasons, such as permissions that are not configured correctly for the user, an account that differs from the one the sharing invitation was sent to, and a site user ID mismatch. This page matches each message to its cause and the fix, for the person who sees the error and for the site owner or administrator.
Which message you see and what it usually means
| What the user sees | Usual cause | What to do |
|---|---|---|
| "You need permission to access this site", "You don't have access to this file" | The user's permissions are not configured correctly | Check the user's permissions and grant what is missing |
| "This link is not available to you" | The account used to open the link is not the account the invitation was sent to | Remove the user from the site, then share the file or folder again |
| "User not found in the directory", or "Let us know why you need access to this site" | A guest accepted an invitation with a different account | Fix the guest account |
| "Access Denied. Due to organization policy, you can't access this resource from this untrusted device." | An unmanaged device policy blocks the device | Review the device policy |
| A 403 error on the whole site | The site is set to NoAccess | SharePoint site lock states covers how to check and unlock |
Check what permissions a user has
Use Check Permissions on the site. You need to be able to open the site's permissions page.
- For a SharePoint site, select Settings, then Site permissions. For a OneDrive site, select Settings, then Site Settings, then Site permissions.
- In the ribbon, select Check Permissions.
- In the User/Group field, enter the user's name, and then select Check Now.
- Review the user's permissions on the site, and check the related security group if there is one.
- If the permissions are not right, grant the user permissions to the file or site. SharePoint permission levels explains what Read, Edit, Contribute and Full Control allow.
- If the user still gets the error, remove the user from the site, then grant the permissions again.
For a guest account that keeps failing, Microsoft recommends removing the guest account completely, making sure the user is removed from the site collection, and then granting permissions again.
Run Check User Access
Microsoft 365 administrators can run a diagnostic in the Microsoft 365 admin center called Check User Access. Microsoft's article has a Run Tests button that opens it. It runs a large range of checks for internal users and guests who try to open SharePoint and OneDrive sites, to find what is affecting their access. Microsoft states that this diagnostic is not available in the GCC High or DoD environments, or in Microsoft 365 operated by 21Vianet.
Guest users: the invitation was accepted with a different account
A guest invitation is a one-time invitation, and it does not have to be accepted with the email address it was sent to. If the guest accepts it with a different account, or signs in with an account other than the invited address, they might see "Access Denied", "Let us know why you need access to this site", "User is not found in the directory" or "You need permission to access this site". Microsoft gives one example: the guest's browser cookies make them accept the invitation with the wrong identity.
The fix has three parts: find which account accepted the invitation, remove the incorrect account, and invite the guest again.
Find the account that accepted the invitation
If you can sign in as the incorrect guest account:
- Sign in with the account that accepted the invitation.
- Select the profile image in the upper-right corner, then My Settings.
- Read the email address in the Account field.
If you cannot sign in as that account, a SharePoint administrator can find it from the site:
- Open the site collection that was shared, select the gear icon for Settings, then Site settings.
- Under Users and Permissions, select People and groups.
- In the address, after
people.aspx?, replaceMembershipGroupId=<number>withMembershipGroupId=0and press Enter. - Find the guest in the list, right-click the name, and copy the shortcut.
- Paste the address into a new browser tab, add
&force=1to the end, and press Enter. The Account field shows the account.
Remove the incorrect account
Remove the guest from each site collection it was shared with. With SharePoint Online Management Shell:
Connect-SPOService -Url https://contoso-admin.sharepoint.com
$ExtUser = Get-SPOExternalUser -Filter guest@fabrikam.com
Remove-SPOExternalUser -UniqueIDs @($ExtUser.UniqueId)
The guest can still appear in search results and in Get-SPOUser after this. To clear the entry from the site's user list, list the users, note the guest's login name (it can start with live.com#), and remove it:
Get-SPOUser -Site https://contoso.sharepoint.com | Format-Table -AutoSize
Remove-SPOUser -Site https://contoso.sharepoint.com -LoginName "live.com#guest@fabrikam.com"
Microsoft's article also covers removing the guest from Microsoft Entra ID with Microsoft Graph PowerShell. Remove-MgUser is a soft delete, and the article shows how to delete the user permanently from the directory recycle bin. Connect-SPOService: connect to SharePoint Online with PowerShell covers the sign-in options for the commands above.
Clear the cache and invite again
Even after a guest is fully removed, the account can remain in the browser cache. Ask the guest to clear the browser cache and to select the Cookies and website data option as well. Then invite the guest to the site using the correct email address. Microsoft's best practice is to copy the invitation link and paste it into an InPrivate browsing session.
Access Denied from an unmanaged device
When an administrator blocks access from unmanaged devices, users see: "Access Denied. Due to organization policy, you can't access this resource from this untrusted device." Microsoft defines unmanaged devices as devices that are not hybrid AD joined or compliant in Intune.
An administrator sets this in the SharePoint admin center under Access control, then Unmanaged devices. The choices are Allow limited, web-only access and Block access. The same setting through PowerShell:
Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess
What to know when users report this:
- Limited access gives browser-only access on an unmanaged device, with no download, print or sync, and no access through apps such as the Office desktop apps.
- Timing: a block can take up to 24 hours to take effect, and it does not affect users who are already signed in from unmanaged devices. Reverting to full access can also take up to 24 hours.
- PDF and image files: the default preview setting,
-LimitedAccessFileType WebPreviewableFiles, lets users preview Office files in the browser. Microsoft says this option is known to cause problems with PDF and image file types, because they can need to be downloaded to render, and that users can get unexpected "Access Denied" errors. The other values areOfficeOnlineFilesOnlyandOtherFiles, and Microsoft advises planning the setting carefully. - Conditional Access: blocking or limiting unmanaged devices relies on Microsoft Entra Conditional Access. Saving the setting in the admin center creates a Conditional Access policy that applies to all users.
- Per site: a site can be set separately with
Set-SPOSite -Identity <site URL> -ConditionalAccessPolicy BlockAccessorAllowLimitedAccess, but the site setting must be at least as restrictive as the organization setting.
A deleted and re-created account: site user ID mismatch
A site user ID mismatch usually happens when a user account is deleted in the Microsoft 365 admin center and a new account is created with the same UPN. The new account gets a new ID even though the UPN is the same, so the site no longer recognizes the person. Microsoft says it can also happen during directory synchronization when users are logged in and then moved to a different OU. For a user who cannot open their own OneDrive, Microsoft's fix is to check whether a new UPN exists, delete the new one, and restore the original. Microsoft also publishes an automated fix titled "Fix site user ID mismatch in SharePoint or OneDrive".
Frequently asked questions
What does "Access Denied" mean in SharePoint?
SharePoint refused the request for the account used. The common causes are permissions that are not configured correctly, an account that differs from the one an invitation or shared link was sent to, a site user ID mismatch, and a policy that blocks the device.
Why do I get "You need permission to access this site" when I already have access?
Check which account you are signed in with, because a different account from the one that was granted access gives this message. A site owner can run Check Permissions for your name. If permissions look right and the error continues, Microsoft's fix is to remove you from the site and grant the access again.
How do I check what permissions a user has?
On the site, select Settings, then Site permissions, then Check Permissions. Enter the user's name, select Check Now, and review the permissions and any related security group.
What does "User not found in the directory" mean?
It is one of the messages a guest sees when they accepted the invitation with a different account. Find the account that accepted the invitation, remove it from each site collection, and invite the guest again.
What does "you can't access this resource from this untrusted device" mean?
An administrator has set the organization or the site to block unmanaged devices. The device is not hybrid AD joined or compliant in Intune. Use a managed device, or ask an administrator whether limited, web-only access suits your organization.
Why do PDFs and images show Access Denied on an unmanaged device?
In limited access mode the default file preview setting can cause problems with PDF and image files, because they can need to be downloaded to render. An administrator can review the -LimitedAccessFileType setting.
How long does an unmanaged device policy take to apply?
A block can take up to 24 hours, and it does not apply to users who are already signed in from unmanaged devices.
Can I run Check User Access in GCC High?
No. Microsoft states the diagnostic is not available in GCC High or DoD, or in Microsoft 365 operated by 21Vianet.
Related reading
- Request access to a SharePoint site - who receives a request and how owners approve it.
- SharePoint site read-only or no access: lock states and how to unlock - the NoAccess lock and the 403 error.
- SharePoint permission levels - what Read, Edit, Contribute and Full Control allow.
- SharePoint 'Sorry, something went wrong': causes and fixes - the generic error and what to give Microsoft Support.
- SharePoint external sharing - sharing with people outside your organization.
- Role-based access control in SharePoint Online - how roles and groups are structured.
- SharePoint admin center - the URL, who can sign in and what each section does.
- Connect-SPOService: connect to SharePoint Online with PowerShell - sign-in options, MFA and the 'not recognized' fix.
Mark Smith co-founded SmiKar Software in 2015 and has spent the past decade helping organisations solve Microsoft 365 data management challenges. He works with the SmiKar team to build solutions for SharePoint archiving, storage optimisation, governance and compliance, supporting customers from growing businesses through to Fortune 500 enterprises.
More about SmiKar
