I guess this is very specific so might be hard to find someone who has a clue - but it's worth trying.

I have a simple console app in c# that adds AD groups to existing SP security groups using REST api. What it does it only POSTs to following url: /_api/web/sitegroups(x)/users (it also includes a form digest value in X-RequestDigest header).

This works fine in my company's environment. This also works on one test site in the client's environment, but in all other sites a WebException is thrown with this error:

401 Unauthorized and inside there is a message: "Access denied. You do not have permission to perform this action or access this resource”.

What's even more interesting: the group is added successfully! Why is the exception thrown then...?

This is very strange as the user that is running the tool can access those sites and can add users to those groups via browser. He has full permissions on those sites. What's happening?

  • Does he have full control or is a site collection administrator? is it the same environment version that you are testing from what is actually working? He might have owner control over a site, that doesn't mean he has complete control over the security group.
    – Yugo
    Jan 11, 2017 at 21:10

5 Answers 5


In case someone else runs into this issue, it most likely doesn't have to do with the USER's permissions, but the actual workflow (workflows don't inherit permissions from the user - but instead run on their own permissions)

I could be wrong about the actual explanation, but if you add the actual HTTP request inside an App Step (so it increases permissions) - the step should work (however it's weird that it throws an error and works anyway) so I could be way off

  • I have the same issue... Except that I do the request in a browser with JavaScript. Sharepoint returns a 401 error, but successfully add the user in the group. Very confusing.... I'm not using a workflow so it's tricky on my side...
    – AymKdn
    Jan 29, 2018 at 9:12

I had a similar issue when comparing permission levels. Try verifying that the group settings for "Who can view/edit the membership of the group?" for each group is set correctly.


As warmfire540 indicated, workflows do not inherit user permissions so you need to configure such updates in an App Step as follows:

  1. Click the Settings icon.
  2. Go to Site Settings.
  3. In the Site Actions section, select Manage site features.
  4. Locate the feature called Workflows can use app permissions, and then click Activate.
  5. FromSite Settings,In the Users and Permissions section, select Site app permissions.
  6. Copy the client section of the App Identifier. This is the identifier between the last "|" and the "@" sign.
  7. Navigate to the Grant permission to an app page. This must be done by browsing to the appinv.aspx page of the site i.e. http://{hostname}/{the Site Collection}/_layouts/15/appinv.aspx.
  8. Paste the client id in the App Id field and then click Lookup.
  9. Paste the following Permissions Request XML to grant full control permission.
  10. <AppPermissionRequests> <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" /> </AppPermissionRequests>
  11. Click Create.
  12. You will then be asked to trust the Workflow app. Click Trust It.
  13. Open the site in SharePoint Designer 2013.
  14. Edit your failing workflow.
  15. Insert an App Step.
  16. Now embed your code that adds the security group inside the App Step.
  17. Publish your workflow.

For a much more detailed explanation including screen shots, see the original article.


I had the same issue, except that I'm using REST in JavaScript from the browser directly. It looks like a bug and several people reported this issue on the Web, but without solutions...

After digging, it looks like the WebService works OK. So I used AddUserToGroup instead of REST API.


In addition to the previous answer check permissions of the user on SP site. See this post.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.