In my SharePoint online environment i have AD groups nested inside a sharepoint group.

AD group: "10024@test"

Inside sharepoint group "members"

Some of the users inside my ad group cant access the startpage. And some of them have access. It seems illogical, what can the problem be?

  • can you see the user in the ad group?
    – Waqas Sarwar MVP
    Commented Jun 11, 2014 at 13:57

2 Answers 2


If you wait a day, does it resolve? If so, it is related to the WindowsTokenLifetime. See this for more info: https://sharelockpoint.wordpress.com/tag/windowstokenlifetime/

Or, if the users were just added to the group, perhaps they need to log off and log in again?

  • So if i understood the windowstokenlifetime correct - After the first time the user logs in to sharepoint, it will take 24 hours before the user can log in to the intranet?
    – Anders
    Commented Jun 11, 2014 at 22:03
  • I really hope a security person chimes in here, but my understanding is that when the user logs in to sp on monday AM, a claims token is generated and cached on the server for the user that contains their group membership info. So, if the user is put in a new group on monday PM, the SharePoint server still uses the same claims token until the original one expires, at which point a new token will be generated with the new list of groups. That's why I asked about waiting a day, as in that time the token will naturally expire.
    – Mike2500
    Commented Jun 12, 2014 at 11:45

In last month I have similar mistake and @mike2500 solution is a good solution for many people but not for me. and search in Google and results pages cant help us.

another parallel problem occur for us when we changed permission and try to test with different users-names and they report : not applying today. and applied after 10 hours and some other changes in user membership groups never applied but if you create new user and grant permission by adding to other groups this is applied only in first time

some users in OraganizationalUnit1 and other users and groups in Organizational unit 2 and when SharePoint can read OU1 and can't read OU2.

and this model occur if you have any other changes never applied.

and only one way that help us is

  1. change the value of WindowsTokenLifetime by this link
  2. try this:right click on OU and grant delegation (read users info) for service account that run application pools in IIS for your SharePoint.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.