📁 Recipe · SharePoint & OneDrive
Grant a User Access to a SharePoint Site
Add a user to a SharePoint site with the correct permission level so they can access the content they need
Complexity
Beginner
Impact
access-management + sharepoint + user-support + permissions
Context
Why This Matters
Why this matters
When employees change roles, join new projects, or report missing access to departmental content (e.g., a Sales or HR SharePoint site), IT admins must grant them access quickly and correctly. Granting too much access creates compliance and data leakage risk; granting too little blocks productivity.
SharePoint sites use three default permission groups:
- Owners — Full control. Typically reserved for site admins.
- Members — Edit access. Appropriate for most collaborators.
- Visitors — Read-only access. Appropriate for consumers of content.
Run this recipe when a user reports they cannot open a SharePoint site or document library they should have access to.
Expected Outcomes
After completing this recipe, you will have:
- Verified the user's identity and the target SharePoint site
- Chosen an appropriate permission level (Owner, Member, or Visitor)
- Added the user to the site's permission group
- Confirmed access by checking the site's membership
- Notified the user (optional) that access has been granted
Risks & Considerations
Warnings & considerations
- Principle of least privilege: Default to Visitor (read-only) or Member (edit). Avoid granting Owner rights unless the user genuinely administers the site.
- Group vs. direct access: If the site is tied to a Microsoft 365 Group or Team, prefer adding the user to the underlying M365 Group — permissions flow through automatically and stay in sync with Teams membership.
- Sharing policies: Some tenants restrict external sharing. Adding a guest user may require additional approval.
- Auditing: Permission changes are logged in the Microsoft Purview audit log. Document the business justification for future review.
- Do not edit the root tenant SharePoint permissions or add users to the "Everyone except external users" group as a workaround.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| SharePoint Administrator | Required to manage site permissions across the tenant via the admin center. |
| Sites.FullControl.All (Graph) | Needed to modify site permissions programmatically via Microsoft Graph. |
| Site Owner (on target site) | Site owners can grant permissions on their own site without tenant-level admin rights. |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
For End Users
How an employee would ask Dex for help
Grant access via SharePoint (Admin Center / Site)
Option A: As a Site Owner (recommended for single-site changes)
- Navigate to the SharePoint site (e.g.,
https://contoso.sharepoint.com/sites/sales). - Click the gear icon (Settings) in the top-right corner.
- Select Site permissions.
- Click Add members → Share site only (to add to SharePoint without adding to the associated M365 Group).
- Enter the user's name or email (e.g.,
israel@contoso.onmicrosoft.com). - Choose the permission level: Read, Edit, or Full control.
- Optionally, uncheck Send email if you do not want the user notified.
- Click Add.
Option B: Via SharePoint Admin Center (for admins managing many sites)
- Sign in to Microsoft 365 Admin Center.
- Navigate to .
- In the SharePoint admin center, go to .
- Click the target site's name to open its properties.
- Select the Membership tab.
- Under the appropriate role (Site admins, Members, or Visitors), click Add.
- Enter the user's email and click Save.
Verify
- Return to Site permissions and confirm the user appears in the correct group.
- Ask the user to reload the site in their browser (they may need to sign out and back in).
Grant site access via Microsoft Graph
Microsoft Graph exposes SharePoint site permissions through the /sites/{site-id}/permissions endpoint. For adding users to the default Members/Owners/Visitors groups, the SharePoint REST API (_api/web) is often more direct.
Step 1: Resolve the site ID
GET https://graph.microsoft.com/v1.0/sites/{hostname}:/sites/{site-name}
Example:
GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/salesResponse includes id in the form {hostname},{site-collection-guid},{web-guid}.
Step 2: Resolve the user's Azure AD object ID
GET https://graph.microsoft.com/v1.0/users/{userPrincipalName}Step 3: Add a site permission (Graph)
POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions
Content-Type: application/json
{
"roles": ["read"],
"grantedToIdentitiesV2": [
{
"user": {
"displayName": "Israel Lifshitz",
"id": "{user-object-id}"
}
}
]
}Valid roles values: read, write, owner.
Alternative: SharePoint REST API (add to default group)
POST https://{tenant}.sharepoint.com/sites/{site}/_api/web/sitegroups/getbyname('{site} Members')/users
Content-Type: application/json;odata=verbose
Accept: application/json;odata=verbose
{
"__metadata": { "type": "SP.User" },
"LoginName": "i:0#.f|membership|user@contoso.com"
}Grant access with PowerShell
The PnP.PowerShell module is the most reliable way to manage SharePoint site permissions from a script. It supports modern auth and works with both SharePoint Online and the M365 Group model.
Prerequisites
# Install the module (one-time)
Install-Module PnP.PowerShell -Scope CurrentUser
# Register a PnP Entra app (one-time, interactive)
Register-PnPEntraIDAppForInteractiveLogin -ApplicationName "PnP-Admin" -Tenant "contoso.onmicrosoft.com" -InteractiveConnect and add the user
# Connect to the target site
Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/sales" -Interactive
# Add user to the Members group (edit access)
Add-PnPGroupMember -LoginName "israel@contoso.onmicrosoft.com" -Group "Sales Members"
# Verify
Get-PnPGroupMember -Group "Sales Members"Permission group names follow the pattern {Site Title} Owners, {Site Title} Members, {Site Title} Visitors. Use Get-PnPGroup to list the actual names on your site.
Next steps